CVE-2026-90703

Executive Summary

CVE-2026-90703 is an OS command injection vulnerability (CWE-77) in D-Link DWR-M921 firmware version 1.1.52, reachable through the system function handling the folderpath argument of /boafrm/formDiskCreateShare. An authenticated remote attacker with high privileges can inject arbitrary OS commands that execute on the device with the web service's privileges, yielding full compromise of the router's confidentiality, integrity, and availability (CVSS 9.1). No vendor patch is available and the exploit has been publicly disclosed, so unpatched, internet-exposed DWR-M921 units represent an immediate takeover risk.

Technical Analysis

The vulnerability resides in the D-Link DWR-M921 firmware's web management application, which is served by the embedded "boa" HTTP daemon. There is no user-supplied field; per the CVSS vector, the attacker is remote (AV:N), no special user interaction is required (UI:N), but the attacker must hold high privileges (PR:H) — meaning a valid administrative session on the device's management interface. This makes the bug a post-authentication command injection, but the impact is self-evident in an internet-exposed household/SOHO router: the attacker who is an authenticated admin is, in practice, the party that wants to persist or exfiltrate.

The affected element is the function system in the file /boafrm/formDiskCreateShare. folderpath is the request parameter that is passed into this function. Critically, the same string that arrives from the client is used, without sanitization, as (or as part of) a shell command passed to a system()-style call — the classic CWE-77/OS command injection pattern. Injection metacharacters such as ;, |, backticks, $(), or newlines embedded in folderpath break out of the intended directory string and execute attacker-controlled shell payload. Because the vulnerable code runs inside the boa process — the same process that renders the management UI and holds the admin session — the injection point is reachable through normal authenticated HTTP POST requests to /boafrm/formDiskCreateShare. The CVSS S:C (scope-changed) score indicates that the vulnerable component's control is used to affect resources beyond its security scope: the crafted HTTP request, after command execution, yields capabilities tied to the whole device rather than just the web interface. The exploitable surface is exposed on any interface where the administrative HTTP server listens, which on these consumer platforms frequently includes the WAN side under default or remote management configurations.

No source code or disassembly is available in the provided dataset; the analysis above is derived strictly from the NVD description — no additional line numbers, internal helper functions, or hidden parameters are asserted.

Exploitation Scenarios

The attack is post-authentication. The description states the exploit is public and usable. The chain proceeds as follows:

1. Reconnaissance and target selection. Scan for the D-Link DWR-M921 administrative interface. The http.title:"DWR-M921" and http.html:"boafrm" Shodan dorks identify exposed management panels on the internet. Target units where /boafrm/formDiskCreateShare is reachable and the admin interface accepts POST requests.
2. Session/credential acquisition. The attacker must hold PR:H (high privileges). This is normally obtained by possessing admin credentials (default/weak credentials, credential reuse, or a separate acquisition path). The provided data does not identify any authentication bypass, so treat credential acquisition as a prerequisite, not part of this CVE's mechanism.
3. Command injection via folderpath. A POST request to /boafrm/formDiskCreateShare containing the folderpath argument. Because the value is placed unsafely into the disk-share creation command executed through system, an injected shell metacharacter terminates the intended directory path and executes attacker-controlled shell commands. The precise injection metacharacter and payload string are deliberately not specified here because the provided description does not supply the source-level sink format.
4. Post-exploitation. Remote code execution as the web process user on the router. Typical actions: exfiltrate device configuration files containing Wi-Fi PSKs and admin credentials; read router logs; install persistence by modifying startup scripts; reconfigure routes and DNS settings for on-path man-in-the-middle or DNS hijacking on the LAN; use the router as a pivot into the home/office network; and potentially recruit the device into a botnet.

Exploitation requires no user interaction and no kernel-level exploit — it is the standard "inject into a shell command built from user input" pattern. As the NVD notes, the exploit is already public, so tooling/scripts circulating online should be assumed to exist.

Impact Assessment

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1 Critical. The impact components are C:H/I:H/A:H — total loss of confidentiality, integrity, and availability of the device. S:C means the impact crosses a security boundary: the injected OS commands run with the privileges of the router's web process and affect the whole device, not only the web management component. Business impact: for a residential/SOHO deployment, this is full router takeover — eventual loss of all sensitive traffic (credentials, session tokens, financial/business data traversing the device), the ability to manipulate DNS/routing to redirect users to attacker infrastructure, and a durable foothold into the internal network. For enterprises/providers that deploy DWR-M921 units as CPE / branch gateways, one vulnerable unit becomes a beachhead into the business LAN. Blast radius: every reachable DWR-M921 running firmware 1.1.52 that exposes /boafrm/formDiskCreateShare and whose admin interface is reachable by the attacker. EPSS 0.02802 at the 85.7th percentile indicates elevated attention relative to other CVEs despite a modest absolute probability score. CISA KEV: NO — no confirmed in-the-wild exploitation reported to the KEV catalog at the time of writing.

Detection Guidance

Sigma Rule

title: D-Link DWR-M921 Command Injection via /boafrm/formDiskCreateShare folderpath
id: 8c4c7f2a-3d9e-4a1b-9f2e-1a2b3c4d5e6f
status: experimental
description: Detects attempts to exploit CVE-2026-90703 (CWE-77) in D-Link DWR-M921 1.1.52 via shell metacharacters in the folderpath parameter of /boafrm/formDiskCreateShare
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90703
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: linux
detection:
  selection_uri:
    cs-uri-stem|contains: '/boafrm/formDiskCreateShare'
  selection_method:
    cs-method: 'POST'
  selection_payload:
    cs-uri-query|contains:
      - 'folderpath='
  selection_metachars:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '`'
      - '$('
      - '&&'
      - '%3B'
      - '%7C'
      - '%60'
      - '%24%28'
  condition: selection_uri and selection_method and selection_payload and selection_metachars
falsepositives:
  - Legitimate folder paths containing characters that appear in encoded metacharacter lists
level: high
tags:
  - attack.t1190
  - cve.2026-90703

YARA Rule

rule CVE_2026_90703_DLink_DWR_M921_CmdInjection
{
    meta:
        description = "Detects HTTP requests attempting command injection in D-Link DWR-M921 /boafrm/formDiskCreateShare folderpath (CVE-2026-90703)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90703"
        date = "2026-01-01"
        cve = "CVE-2026-90703"
    strings:
        $uri = "/boafrm/formDiskCreateShare" ascii nocase wide
        $param = "folderpath" ascii nocase wide
        $m1 = ";" ascii
        $m2 = "|" ascii
        $m3 = "`" ascii
        $m4 = "$(" ascii
        $m5 = "&&" ascii
        $enc1 = "%3B" ascii nocase wide
        $enc2 = "%7C" ascii nocase wide
    condition:
        $uri and $param and 1 of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90703 D-Link DWR-M921 /boafrm/formDiskCreateShare folderpath Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/boafrm/formDiskCreateShare"; http_client_body; content:"folderpath"; http_client_body; pcre:"/(folderpath[^\r\n]{0,200}?)(%3B|%7C|%60|%24%28|;|\||`|\$\()/i"; reference:cve,2026-90703; classtype:web-application-attack; sid:202690703; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and url.path == "/boafrm/formDiskCreateShare" and url.query : "folderpath" ]
  [ network where http.request.method == "POST" and url.full : ("/boafrm/formDiskCreateShare") and
      (url.query : ("*;*" or "*%3B*" or "*|*" or "*%7C*" or "*`*" or "*%60*" or "*$(*" or "*%24%28*" or "*&&*")) ]

Splunk SPL Query

index=web
| search http_method=POST uri="/boafrm/formDiskCreateShare"
| eval fp=coalesce(folderpath, url_query, raw)
| where match(fp, "(?i)(%3B|;|%7C|\||%60|`|%24%28|\$\(|&&)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips by dest_ip uri
| sort - count

Wazuh OSSEC Rule

<group name="web,router,attack,cve_2026_90703">
  <rule id="2026907" level="12">
    <if_sid>31100</if_sid>
    <match>POST|/boafrm/formDiskCreateShare</match>
    <regex>folderpath[^\r\n]{0,200}(%3B|%7C|%60|%24%28|;|\||`|\$\(|&&)</regex>
    <description>CVE-2026-90703: D-Link DWR-M921 OS command injection attempt on /boafrm/formDiskCreateShare folderpath</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_90703,</group>
  </rule>
</group>

Note: adapt the parent SID (if_sid) to the web-access-log decoder in your deployment.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, OSV packages, or vendor advisory were provided.

1. Immediate mitigations

• Remove D-Link DWR-M921 administrative interfaces from direct internet reachability. Block WAN access to the web UI / boafrm paths (port 80/443 admin service) at the perimeter firewall and with carrier-grade NAT where possible.
• Disable remote management. If remote administration cannot be disabled, restrict it to source-IP allowlists / an out-of-band VPN.
• Enforce strong, unique admin credentials on the device; rotate the admin password and Wi-Fi PSKs on any unit suspected of compromise. Because the exploitation path is post-auth and PR:H, credential hygiene and disabling default accounts exercise the only practical barrier available.
• Isolate routers/CPE to a management VLAN and monitor device egress for anomalous outbound traffic (unexpected DNS servers, new tunnels, internal host scans).
• Apply compensating network-layer filters: block or alert on requests to /boafrm/formDiskCreateShare that contain shell metacharacters in the folderpath argument (see detection rules above) until a vendor fix is available.

2. Patch/upgrade steps

• There is currently no identified patch. Contact D-Link support / monitor the D-Link security advisory page for DWR-M921 fixed-firmware release. Do not assume 1.1.52 or any later untested build is fixed without vendor confirmation.
• When a patched firmware becomes available: schedule an upgrade during a maintenance window, back up configuration, upgrade, verify the device no longer exposes the vulnerable behavior, then re-apply hardening. Firmware inventory and version attestation across the estate are prerequisites.

3. Long-term hardening

• Institute a firmware/vulnerability management program covering CPE and SOHO routers (asset inventory, periodic version checks, and coordinated replacement timelines).
• Retire end-of-support D-Link (or any vendor) devices; replace with actively maintained models or provider-managed CPE.
• Adopt secure defaults baseline: no remote admin, unique admin credentials, signed/verified firmware updates, and authenticated device management.
• Threat-model the management plane as a high-value asset; log and monitor all POST requests to embedded form endpoints and alert on command-metacharacter patterns as a standing rule.

References

• NVD — CVE-2026-90703: https://nvd.nist.gov/vuln/detail/CVE-2026-90703
• MITRE CWE-77 (Improper Neutralization of Special Elements used in a Command / 'Command Injection'): https://cwe.mitre.org/data/definitions/77.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• D-Link Security Advisories (vendor portal — check for DWR-M921 fix): https://www.dlink.com/en/security-bulletin
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-90703 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit status: No specific threat actor campaign is identified in the provided data. NVD states the exploit "has been disclosed to the public and may be used." EPSS 0.02802 (85.7th percentile) and the absence of a CISA KEV entry indicate elevated-but-not-yet-mass-exploited status. Treat as imminent-risk until a patch is published and verified.