CVE-2026-90704 MEDIUM

CVE-2026-90704: D-Link DWR-M921 formDiskPartition system command injection

Vendor D-Link

Product DWR-M921

Weakness CWE-77

Published September 14, 2026

Last update September 14, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

What the vulnerability does

01Description

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Key dates

02Disclosure timeline

September 14, 2026 CVE published

September 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-90704 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html AskarLabs — CWE-77 write-up Command Injection

Related vulnerabilities

04Related CVE

CVE-2024-37091 WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability CVE-2026-7693 Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter CVE-2026-10195 FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting CVE-2025-22630 WordPress Widget Options Plugin <= 4.1.0 - Arbitrary Code Execution vulnerability CVE-2023-6999 Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution