CVE-2026-90702

Executive Summary

CVE-2026-90702 is an OS command injection vulnerability (CWE-77) in the D-Link DWR-M921 router, firmware version 1.1.52, reachable through the /boafrm/formDiskFormat endpoint. The flaw affects the system function and is triggered by manipulating the partition argument, allowing a remote authenticated attacker with elevated privileges to execute arbitrary operating system commands on the device. With a CVSS v3.1 base score of 9.1 (Critical) and confirmed public exploit publication, unpatched DWR-M921 devices represent a severe risk of full device compromise, lateral movement into the internal network, and persistent unauthorized access.

Technical Analysis

CVE-2026-90702 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command — "Command Injection"). The vulnerability resides in the system function processing logic associated with the web resource /boafrm/formDiskFormat. In this firmware build, the partition argument supplied to that endpoint is not adequately sanitized before being passed into a shell command context, allowing an attacker to append or inject arbitrary shell metacharacters that execute with the privilege context of the underlying web/management service.

Key technical characteristics derivable from the available data:

• Affected component: D-Link DWR-M921, firmware 1.1.52. The vulnerable surface is the router's embedded web management interface (Boa-derived /boafrm/ form-handling subsystem).
• Vulnerable function: system — a standard C library routine that dispatches commands to the host shell. When user-controlled input reaches this function without validation, injected command syntax is interpreted by the shell.
• Injection vector: The partition parameter submitted to /boafrm/formDiskFormat. This endpoint logically handles disk/USB storage formatting operations, which on embedded routers typically require elevated (often root) privileges to invoke utilities such as format/mkfs tooling.
• Authentication requirement: The CVSS vector specifies PR:H (Privileges Required: High), meaning the attacker must first hold administrative-level credentials to reach the vulnerable form. The NVD description states the attack "may be initiated remotely" (AV:N), so an attacker on the network — or one who has obtained admin credentials via default/weak passwords or prior compromise — can trigger it over HTTP/HTTPS.
• Scope change: S:C (Scope Changed) reflects that successful exploitation lets the attacker affect resources beyond the vulnerable component's original security authority — i.e., the entire underlying operating system, not just the web service.
• Impact subscores: C:H / I:H / A:H — complete loss of confidentiality, integrity, and availability.

Because no patch, Nuclei template, or exploit code artifact is tracked in the supplied dataset, the precise metacharacter payload and the exact shell command wrapper are not documented here. The mechanism should be understood at the class level: unsanitized partition input flows into a shell invocation, and shell metacharacters (command separators, substitution operators, or redirection) enable secondary command execution.

Exploitation Scenarios

The following attack chain is constructed strictly from the NVD description and the vulnerability class (CWE-77). No public PoC code is present in the supplied data; the chain is inferred at the vulnerability-class level. The NVD states the exploit "has been published and may be used," so we treat exploitation as feasible in the wild.

1. Reconnaissance / Target Identification An attacker identifies exposed D-Link DWR-M921 management interfaces via internet-wide scanning (see Shodan dorks in METADATA) or during internal network enumeration. The /boafrm/ web management surface is fingerprinted by requesting known form endpoints or observing the router's login page and firmware banner.

2. Prerequisite Access Because the CVSS vector requires PR:H, the attacker must obtain administrative credentials. In practice this is achieved through default credentials, credential reuse, brute force against the management login, or a separate prior compromise. With admin session access established, the attacker can reach the form handler for /boafrm/formDiskFormat.

3. Triggering the Flaw (class-level) The attacker submits a request to /boafrm/formDiskFormat where the partition argument contains shell metacharacters appended to (or substituted for) the expected partition value. Because the value is passed to the system function without neutralization, the injected shell syntax is interpreted and the unintended command executes under the privilege of the management service (typically root on embedded routers).

4. Payload / Execution Method (class-level) At the vulnerability-class level, the payload is an OS command smuggled through shell metacharacters in the partition field. The exact delimiter and command syntax are not published in the supplied data. The attacker's objective at this stage is arbitrary command execution — e.g., spawning a reverse shell, downloading a secondary payload, or writing a persistence artifact.

5. Post-Exploitation Impact Successful exploitation yields OS-level command execution as the web service user (frequently root on this class of device). From there, typical post-exploitation activity includes: reading device configuration (including stored credentials and Wi-Fi PSKs), altering firewall/NAT rules to expose internal hosts, installing persistent backdoors, recruiting the device into a botnet, or using it as a pivot into the internal network. The S:C scope change confirms the blast radius extends to the entire device OS.

Impact Assessment

• CVSS v3.1 Base: 9.1 (Critical) — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV:N): Network-reachable, exploitable remotely.
• Attack Complexity (AC:L): Low — no special conditions beyond the required access.
• Privileges Required (PR:H): Requires administrative credentials, which slightly narrows the attack population but is frequently attainable via default credentials.
• User Interaction (UI:N): No victim action needed.
• Scope (S:C): Changed — impact escapes the web service into the host OS.
• C/I/A: High across all three — complete compromise of confidentiality, integrity, and availability.

Business impact: A compromised SMB/edge router can expose all internal traffic to interception, enable attacker pivot into the LAN, and facilitate persistent remote access. Affected systems are D-Link DWR-M921 running firmware 1.1.52. Blast radius per device is total (S:C, all-High impact); for organizations with many deployed units, the aggregate exposure is severe, and because the flaw is UNPATCHED with a published exploit, dwell time may be extended.

Detection Guidance

Sigma Rule

title: D-Link DWR-M921 OS Command Injection Attempt via formDiskFormat
id: 6f2b9c1a-4d3e-4a7b-9c2f-2026907a0001
status: experimental
description: Detects HTTP requests to the D-Link DWR-M921 /boafrm/formDiskFormat endpoint with shell metacharacters in the partition argument, indicating CVE-2026-90702 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90702
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/boafrm/formDiskFormat'
  selection_payload:
    cs-uri-query|contains:
      - 'partition='
  selection_metachar:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '`'
      - '$('
      - '&&'
  condition: selection_endpoint and selection_payload and selection_metachar
falsepositives:
  - Legitimate partition labels containing unusual characters (unlikely)
level: high
tags:
  - attack.t1190
  - cve.2026.90702

YARA Rule

rule CVE_2026_90702_DLink_DWR_M921_CmdInjection
{
    meta:
        description = "Detects references to CVE-2026-90702 exploitation of D-Link DWR-M921 /boafrm/formDiskFormat partition parameter"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90702"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $ep  = "/boafrm/formDiskFormat" ascii nocase
        $arg = "partition=" ascii nocase
        $m1  = ";" ascii
        $m2  = "$(" ascii
        $m3  = "|" ascii
        $m4  = "`" ascii
        $m5  = "&&" ascii

    condition:
        $ep and $arg and any of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90702 D-Link DWR-M921 formDiskFormat partition OS Command Injection Attempt"; flow:to_server,established; http.uri; content:"/boafrm/formDiskFormat"; http.uri; content:"partition="; http.uri; pcre:"/partition=[^&]*(%3B|;|%7C|\||%60|`|%24%28|\$\(|%26%26|&&)/i"; classtype:web-application-attack; reference:cve,2026-90702; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90702; sid:2026907001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where http.request.method == "POST"
    and url.path == "/boafrm/formDiskFormat"]
  [network where url.path == "/boafrm/formDiskFormat"
    and wildcard(http.request.body, "*partition=*")
    and (wildcard(http.request.body, "*;*")
      or wildcard(http.request.body, "*|*")
      or wildcard(http.request.body, "*$(*")
      or wildcard(http.request.body, "*&&*")
      or wildcard(http.request.body, "*%60*"))]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri_stem)
| where like(uri, "%/boafrm/formDiskFormat%")
| eval q=coalesce(query, cs_uri_query, form_data)
| where like(q, "%partition=%") AND (like(q, "%;%") OR like(q, "%|%") OR like(q, "%$%28%") OR like(q, "%&&%") OR like(q, "%60%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(q) as payload by src, dest, uri
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,dlink,cve-2026-90702,">
  <rule id="2026907" level="12">
    <if_sid>31100,31108,31533</if_sid>
    <match>boafrm/formDiskFormat</match>
    <regex>partition=.*(;|\||`|\$\(|&amp;&amp;)</regex>
    <description>CVE-2026-90702: Possible OS command injection attempt against D-Link DWR-M921 /boafrm/formDiskFormat (partition parameter)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_90702,command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, firmware update, or patch reference for CVE-2026-90702 is present in any tracked source. The following actions are recommended based on the vulnerability class and deployment reality.

1. Immediate mitigations

   • Remove or block internet exposure of the DWR-M921 management interface. Do not permit /boafrm/ endpoints to be reachable from untrusted networks. Restrict administrative access to a dedicated management VLAN with strict ACLs.
   • Rotate administrative credentials and eliminate default/weak passwords, since PR:H gates exploitation — reducing credential availability meaningfully lowers risk.
   • Enable and monitor web management logging; forward to the SOC for the detections above.
   • Replace end-of-life or unpatchable units with supported hardware if D-Link confirms no fix will be issued.

2. Patch / upgrade steps

   • Monitor D-Link's official security advisory portal and firmware download page for the DWR-M921. No patch exists as of writing.
   • If/ when a fixed firmware is released, validate the build, back up configuration, apply the firmware, and verify the /boafrm/formDiskFormat endpoint no longer passes unsanitized input to system commands.
   • Confirm the applied version numerically exceeds 1.1.52.

3. Long-term hardening

   • Enforce network segmentation so router management planes are unreachable laterally.
   • Adopt a firmware asset inventory with periodic CVE correlation and upgrade SLAs for edge devices.
   • Disable unused services (USB storage formatting, remote management) where not operationally required.
   • Apply WAF/virtual patching to reject requests containing shell metacharacters in the partition field as a compensating control.

References

• NVD — CVE-2026-90702: https://nvd.nist.gov/vuln/detail/CVE-2026-90702
• MITRE CWE-77 (Command Injection): https://cwe.mitre.org/data/definitions/77.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• D-Link Security Advisory portal (monitor for DWR-M921 firmware fix): https://support.dlink.com/securityadvisories
• CISA KEV Catalog (verify status; currently NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: The NVD description explicitly states the exploit "has been published and may be used," and the EPSS score of 0.02802 places this CVE in the 85.7th percentile of exploited-vulnerability likelihood — indicating elevated near-term exploitation probability. No specific threat actor campaign is attributed in the supplied data.