CVE-2026-90702: D-Link DWR-M921 OS Command Injection via Disk Format Handler

Overview

A critical OS command injection vulnerability has been disclosed in the D-Link DWR-M921 router, firmware version 1.1.52. Tracked as CVE-2026-90702, the flaw sits in the system function of /boafrm/formDiskFormat, the handler that formats USB storage attached to the router, and can be triggered remotely without authentication.

This is one of two related OS command injection flaws disclosed in DWR-M921 firmware on the same day — see also CVE-2026-90703, which affects the disk share handler.

Technical Details

How It Works

The formDiskFormat endpoint accepts a partition parameter that identifies which storage partition on router-attached USB media to format. That value is concatenated directly into a system() call rather than being validated against a known device list, so shell metacharacters embedded in partition let an attacker run arbitrary commands with the privileges of the disk-management process.

Impact Assessment

The DWR-M921 exposes built-in USB/NAS-style storage sharing, a feature commonly left enabled and reachable on the LAN — and in poorly segmented deployments, the internet. A successful exploit yields command execution as the router's storage-management process, which typically has access to attached storage, the filesystem, and the network stack.

Potential Attack Chains

1. Attacker reaches the router's web management interface, directly if internet-exposed or from an adjacent LAN segment.
2. A crafted partition value containing shell metacharacters is submitted to formDiskFormat.
3. Injected commands execute with the router's storage-process privileges.
4. The compromised device is used to exfiltrate data from attached storage, pivot into the LAN, or is conscripted into an IoT botnet.

Mitigation

• Check D-Link's support portal for a firmware update addressing CVE-2026-90702 and apply it as soon as one is released — no patched firmware was referenced in the disclosure at time of writing.
• Never expose router management interfaces to the internet. Restrict access to formDiskFormat and other admin endpoints to trusted internal networks or a management VLAN.
• Disable USB storage sharing on the router if the feature is not actively required.
• Segment routers with attached storage away from sensitive internal systems to limit blast radius if the device is compromised.
• Consider replacing end-of-support D-Link hardware with actively patched alternatives in environments with elevated security requirements.

References

• NVD — CVE-2026-90702
• CISA Known Exploited Vulnerabilities Catalog