Skip to main content
IMMUNITYSEC

CVE-2026-2085

D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injection

8.6
HIGH
CVSS 4.0
EPSS 5.2% · 92nd pctCWE-77CWE-74
2026-02-07•Updated 2026-02-23

Description

A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component USSD Configuration Endpoint. The manipulation of the argument ussdValue leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Severity

CVSS 4.0 · CNA8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1 · CNA7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CVSS 3.0 · CNA7.2 HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CVSS 2.0 · CNA8.3 HIGH
AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
SSVC · CISA-ADP
Exploitationpoc
Automatableno
Technical impacttotal

Affected Products

VendorProductAffected versions
D-LinkDWR-M921
1.1.50

References

6 Links

Record Details

Published
2026-02-07
Last updated
2026-02-23
Assigner (CNA)
VulDB
Credited to
LX-66-LX (VulDB User)

More from D-Link

All D-Link CVEs→
CVE-2024-32737.5

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

CVE-2019-169209.8

D-Link Multiple Routers Command Injection Vulnerability

CVE-2020-255069.8

D-Link DNS-320 Device Command Injection Vulnerability

CVE-2024-327210

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.