GCVE - cpe:2.3:h:d-link:dwr-m920:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:d-link:dwr-m920:*:*:*:*:*:*:*:*

part: h version: * update: *

Vendor	D Link (`f324da99-07b9-589f-a800-1ce04a08f309`)
Product	Dwr M920 (`cf39527b-e456-531a-b0fe-8b9e30f62156`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-90699`	vulnerable	2026-09-16 04:33:05.315005	D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection CRITICAL (9.9) A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Published: 2026-09-14T08:45:10.221Z Updated: 2026-09-14T10:16:22.885Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/403232 https://vuldb.com/vuln/403232/cti https://vuldb.com/cve/CVE-2026-90699 https://vuldb.com/submit/916259 https://github.com/H3rmesk1t/vulnerability-paper/issues/9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-11341`	vulnerable	2026-06-08 07:47:14.113350	D-Link DWR-M920 formIMEISetup sub_412DA0 os command injection MEDIUM (6.3) A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI_value causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. Published: 2026-06-05T16:45:09.150Z Updated: 2026-06-05T19:37:29.092Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/368882 https://vuldb.com/vuln/368882/cti https://vuldb.com/cve/CVE-2026-11341 https://vuldb.com/submit/832593 https://github.com/7u7777/Dlink/blob/DWR-M920/formIMEISetup.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-11339`	vulnerable	2026-06-08 07:47:14.113156	D-Link DWR-M920 formUSSDSetup sub_41CF20 command injection MEDIUM (6.3) A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. Published: 2026-06-05T16:30:11.653Z Updated: 2026-06-09T14:37:14.423Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/368881 https://vuldb.com/vuln/368881/cti https://vuldb.com/cve/CVE-2026-11339 https://vuldb.com/submit/832579 https://github.com/7u7777/Dlink/blob/DWR-M920/formUSSDSetup.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-10878`	vulnerable	2026-06-08 07:47:13.936923	D-Link DWR-M920 formSmsManage sub_41C8E8 command injection MEDIUM (6.3) A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub_41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument action_value results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Published: 2026-06-05T00:00:17.909Z Updated: 2026-06-05T19:28:05.511Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/368368 https://vuldb.com/vuln/368368/cti https://vuldb.com/cve/CVE-2026-10878 https://vuldb.com/submit/832154 https://github.com/7u7777/Dlink/blob/DWR-M920/formSmsManage.md	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.