What is CVE-2026-90704?

CVE-2026-90704 is a medium-severity vulnerability in D-Link Dwr-M921, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 6.6/10. Published 2026-09-14.

How severe is CVE-2026-90704?

Medium severity. CVSS v3 base score is 6.6 out of 10.

RCE in D-Link Dwr-M921

CVE-2026-90704

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Published 2026-09-14 · last modified 2026-09-14.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.023 (83.4th percentile), scored 2026-10-30.

Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 83.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.023 · newest: 0.023 · change: 0.000

Affected products

D-Link Dwr-M921 — versions 1.1.52

Weakness classification (CWE)

References

gist.github.com/H3rmesk1t/2052767b9fb397e311c17383a0e19021 (exploit)
vuldb.com/cve/CVE-2026-90704 (third-party-advisory)
vuldb.com/submit/917696 (third-party-advisory)
vuldb.com/vuln/403246 (technical-description, vdb-entry)
vuldb.com/vuln/403246/cti (signature, permissions-required)
www.dlink.com/ (product)

Frequently asked questions

What is CVE-2026-90704?: CVE-2026-90704 is a medium-severity vulnerability in D-Link Dwr-M921, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 6.6/10. Published 2026-09-14.
How severe is CVE-2026-90704?: Medium severity. CVSS v3 base score is 6.6 out of 10.