D-Link DWR Routers Hit by Three Critical Command Injections

Three critical-severity OS command injection vulnerabilities have been disclosed in D-Link’s DWR mobile router series, covering two models. Researcher H3rmesk1t published technical details in public gists on September 13 and 14, 2026. D-Link has not released a firmware update or security advisory for any of them.

The root cause is the same in each case. Both the DWR-M920 and the DWR-M921 run the BOA embedded web server, a single-threaded HTTP daemon that has been a fixture in SOHO and IoT firmware for decades. Several of the BOA request handlers in these models pass form parameters directly into system() shell calls without sanitizing the input. An attacker who can reach the management interface can inject arbitrary OS commands through those parameters.

The three CVEs and their endpoints:

• CVE-2026-90699 (CVSS 9.9, critical): DWR-M920 firmware 1.1.7. The newPin field in /boafrm/formPinManageSetup reaches system() in function sub_41E60C without sanitization. NVD
• CVE-2026-90702 (CVSS 9.1, critical): DWR-M921 firmware 1.1.52. The partition field in /boafrm/formDiskFormat passes to the system shell unsanitized. NVD
• CVE-2026-90703 (CVSS 9.1, critical): DWR-M921 firmware 1.1.52. The folderpath field in /boafrm/formDiskCreateShare carries the same class of flaw. NVD

Device context

The DWR-M920 and DWR-M921 are 4G LTE mobile routers, built for home, small office, and field deployment scenarios where a wired broadband connection is absent or serves as a fallback. Devices in this class tend to receive firmware updates infrequently. They often sit at a network edge for months or years on shipping firmware, and management interfaces frequently remain accessible on the LAN without additional access controls in place.

Unsanitized system() calls in BOA handlers are a persistent pattern in embedded firmware. The same firmware architecture appeared in ZBT routers found to ship with factory-installed root backdoors and in the CVSS 9.9 RCE in Advantech WISE-6610 firmware reported earlier this month.

What to do

No patch is available. Until D-Link publishes a firmware update, restrict access to the web management interface: put it behind a firewall rule or VLAN segment that allows only specific trusted hosts. Do not expose the management port on the WAN interface. On networks where the management VLAN is not isolated, that network segment needs access controls.

Monitor D-Link’s security bulletin page for an advisory.