Description (CNA)
A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| D-Link / DWR-M920 | affected 1.1.0; affected 1.1.1; affected 1.1.2; affected 1.1.3; affected 1.1.4; affected 1.1.5; affected 1.1.6; affected 1.1.7; affected 1.1.8; affected 1.1.9; affected 1.1.10; affected 1.1.11; affected 1.1.12; affected 1.1.13; affected 1.1.14; affected 1.1.15; affected 1.1.16; affected 1.1.17; affected 1.1.18; affected 1.1.19; affected 1.1.20; affected 1.1.21; affected 1.1.22; affected 1.1.23; affected 1.1.24; affected 1.1.25; affected 1.1.26; affected 1.1.27; affected 1.1.28; affected 1.1.29; affected 1.1.30; affected 1.1.31; affected 1.1.32; affected 1.1.33; affected 1.1.34; affected 1.1.35; affected 1.1.36; affected 1.1.37; affected 1.1.38; affected 1.1.39; affected 1.1.40; affected 1.1.41; affected 1.1.42; affected 1.1.43; affected 1.1.44; affected 1.1.45; affected 1.1.46; affected 1.1.47; affected 1.1.48; affected 1.1.49; affected 1.1.50 |
CWE
CWE-77, CWE-74
References
- https://vuldb.com/vuln/368881
- https://vuldb.com/vuln/368881/cti
- https://vuldb.com/cve/CVE-2026-11339
- https://vuldb.com/submit/832579
- https://github.com/7u7777/Dlink/blob/DWR-M920/formUSSDSetup.md
- https://www.dlink.com/
ADP enrichment
No English description supplied.
No references supplied.