Summary
generated automatically from NVD dataD-Link DWR-M921 version 1.1.52 contains an OS command injection flaw (CWE-77) in the system function of the /boafrm/formDiskCreateShare file. Manipulating the folderpath argument lets an attacker run operating system commands, and the attack can be launched remotely. The NVD notes that the exploit has been disclosed publicly, and the flaw is rated 9.1 (CRITICAL, CVSS v3.1).
NVD description
A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
EPSS · FIRST.org
3.6%probability of exploitation in the next 30 days
Higher than 89% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 14 sept. 2026
- Updated
- 15 sept. 2026
- Status
- Deferred
- Source
- cna@vuldb.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-77
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.