Description

A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

Related CPE's

Could not find any relations

References

https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeFibocom.md

https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeFibocom.md#poc

https://vuldb.com/?ctiid.338576

https://vuldb.com/?id.338576

https://vuldb.com/?submit.723554

https://www.dlink.com/

Weaknesses

[email protected]

Primary
CWE-74CWE-77

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

6.3 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Undergoing analysis

Published

2025-12-29T14:15:56.427

3 hours ago

Last modified

2025-12-29T15:57:37.560

1 hour ago