CVE-2026-90702

CVSS 9.1 (critical) · published 2026-09-14

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used.

Weakness: CWE-77, CWE-78

Source: NVD CVE-2026-90702

References

• https://gist.github.com/H3rmesk1t/1f7efbf4584ce13222e8b0c669e7784a
• https://vuldb.com/cve/CVE-2026-90702
• https://vuldb.com/submit/917692
• https://vuldb.com/vuln/403244
• https://vuldb.com/vuln/403244/cti
• https://www.dlink.com/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.