Dwr-m921 Firmware vulnerabilities

6 known vulnerabilities in Dwr-m921 Firmware from D-Link. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  DWR-M921: Improper Neutralization of Special Elements used in a Command

  CVE-2026-2169Feb 8, 2026D-LinkEPSS 3.44%

  A vulnerability has been found in D-Link DWR-M921 1.1.50. This impacts an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of the argument fota_url leads to command injection. It is possible to launch the attack remotely. The e

• 8.8 High severity

  DWR-M921: Improper Neutralization of Special Elements used in a Command

  CVE-2026-2168Feb 8, 2026D-LinkEPSS 3.78%

  A flaw has been found in D-Link DWR-M921 1.1.50. This affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. It is possible to initiate the attack remotely. The exploi

• 7.2 High severity

  DWR-M921: Improper Neutralization of Special Elements used in a Command

  CVE-2026-2085Feb 7, 2026D-LinkEPSS 10.5%

  A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component USSD Configuration Endpoint. The manipulation of the argument ussdValue leads to command injection. The

• 8.8 High severity

  DWR-M920: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-13306Nov 18, 2025D-LinkEPSS 8.25%

  A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formDebugDiagnosticRun. The manipulation of the argument host leads to command injection. Remote exploitat

• 9.8 Critical severity

  DWR-M920: Buffer Copy without Checking Size of Input

  CVE-2025-13305Nov 17, 2025D-LinkEPSS 3.85%

  A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer ove

• 8.8 High severity

  DWR-M920: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-13304Nov 17, 2025D-Link

  A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer