ByteOS Network

CVE Vulnerability Details :

CVE-2026-11341

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-05 Jun, 2026 | 16:45

Updated At-05 Jun, 2026 | 19:37

▼CVE Numbering Authority (CNA)

D-Link DWR-M920 formIMEISetup sub_412DA0 os command injection

A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI_value causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.

Affected Products

Vendor

D-Link Corporation

Product

DWR-M920

CPEs

cpe:2.3:h:d-link:dwr-m920:*:*:*:*:*:*:*:*

Versions

Affected

1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.1.12
1.1.13
1.1.14
1.1.15
1.1.16
1.1.17
1.1.18
1.1.19
1.1.20
1.1.21
1.1.22
1.1.23
1.1.24
1.1.25
1.1.26
1.1.27
1.1.28
1.1.29
1.1.30
1.1.31
1.1.32
1.1.33
1.1.34
1.1.35
1.1.36
1.1.37
1.1.38
1.1.39
1.1.40
1.1.41
1.1.42
1.1.43
1.1.44
1.1.45
1.1.46
1.1.47
1.1.48
1.1.49
1.1.50

Problem Types

Type	CWE ID	Description
CWE	CWE-78	OS Command Injection
CWE	CWE-77	Command Injection

Type: CWE

CWE ID: CWE-78

Description: OS Command Injection

Type: CWE

CWE ID: CWE-77

Description: Command Injection

Metrics

Version	Base score	Base severity	Vector
4.0	5.3	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
3.0	6.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
2.0	6.5	N/A	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Version: 4.0

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Version: 3.0

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Version: 2.0

Base score: 6.5

Base severity: N/A

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Credits

reporter

kkff33 (VulDB User)

Timeline

Event	Date
Advisory disclosed	2026-06-05 00:00:00
VulDB entry created	2026-06-05 02:00:00
VulDB entry last update	2026-06-05 10:24:16

Event: Advisory disclosed

Date: 2026-06-05 00:00:00

Event: VulDB entry created

Date: 2026-06-05 02:00:00

Event: VulDB entry last update

Date: 2026-06-05 10:24:16

References

Hyperlink	Resource
https://vuldb.com/vuln/368882	vdb-entry technical-description
https://vuldb.com/vuln/368882/cti	signature permissions-required
https://vuldb.com/cve/CVE-2026-11341	third-party-advisory
https://vuldb.com/submit/832593	third-party-advisory
https://github.com/7u7777/Dlink/blob/DWR-M920/formIMEISetup.md	exploit
https://www.dlink.com/	product

Hyperlink: https://vuldb.com/vuln/368882

Resource:

vdb-entry

technical-description

Hyperlink: https://vuldb.com/vuln/368882/cti

Resource:

signature

permissions-required

Hyperlink: https://vuldb.com/cve/CVE-2026-11341

Resource:

third-party-advisory

Hyperlink: https://vuldb.com/submit/832593

Resource:

third-party-advisory

Hyperlink: https://github.com/7u7777/Dlink/blob/DWR-M920/formIMEISetup.md

Resource:

exploit

Hyperlink: https://www.dlink.com/

Resource:

product

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References