Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-2168: D-Link DWR-M921 Router: Unsecured Upgrade Process Allows Remote Code Execution
CVE-2026-2168 · published 8 months ago
Summary
A critical security issue has been discovered in D-Link DWR-M921 routers running version 1.1.50. An attacker can remotely send malicious data to the router, potentially allowing them to execute unauthorized code. To protect your network, update your router's firmware to the latest version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dlink | dwr-m921_firmware |
1.1.50 cpe:2.3:o:dlink:dwr-m921_firmware:1.1.50:*:*:*:*:*:*:* |
Original advisory text
A flaw has been found in D-Link DWR-M921 1.1.50. This affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command inject...
A flaw has been found in D-Link DWR-M921 1.1.50. This affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
References
- https://github.com/LX-66-LX/cve-new/issues/2 Exploit Issue Tracking
- https://vuldb.com/?ctiid.344870 Permissions Required VDB Entry
- https://vuldb.com/?id.344870 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.748838 Third Party Advisory VDB Entry
- https://www.dlink.com/ Product
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-74Injection
CWE-77Command Injection
Timeline
Published8 Feb 2026
Updated23 Oct 2026
First seen6 Mar 2026
Sources
CVE-2026-2168 · NVD
Track software like this
Free during beta