CVE-2026-11339
6.3 MEDIUMA vulnerability was detected in D-Link DWR-M920 up to 1.1.50
Published: 2026-06-05 · Last updated: 2026-06-09
Severity and scoring
- CVSS
- 6.3 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CWE
- CWE-74, CWE-77
Affected products
| Vendor | Product |
|---|---|
| dlink | dwr-m920_firmware |
Description
A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-11339
- [Exploit reference]https://github.com/7u7777/Dlink/blob/DWR-M920/formUSSDSetup.md
- [Other]https://vuldb.com/cve/CVE-2026-11339
- [Other]https://vuldb.com/submit/832579
- [Other]https://vuldb.com/vuln/368881
- [Other]https://vuldb.com/vuln/368881/cti
- [Other]https://www.dlink.com/
Related CVEs
Same vendor
- CVE-2026-11555 — A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006 (3.7 LOW)
- CVE-2026-11497 — A vulnerability has been found in D-Link DCS-5615 1.01.00 (5.3 MEDIUM)
- CVE-2026-11492 — A security flaw has been discovered in D-Link DIR-823G 1.0.2B05 (4.3 MEDIUM)
- CVE-2026-10878 — A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70 (6.3 MEDIUM)
- CVE-2026-10270 — A vulnerability was detected in D-Link DI-7001 MINI up to 19.09.19A1 (8.8 HIGH)
Same CWE
- CVE-2026-46529 — Atril Document Viewer is the default document reader of the MATE desktop environment for Linux
- CVE-2026-45558 — Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers (9.9 CRITICAL)
- CVE-2026-11859 — An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation...
- CVE-2026-46546 — Frappe Learning Management System (LMS) is a learning system that helps users structure their content
- CVE-2026-47634 — Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized ... (7.3 HIGH)