CVE-2026-90703: D-Link DWR-M921 OS Command Injection via Disk Share Handler

Overview

A critical OS command injection vulnerability has been disclosed in the D-Link DWR-M921 router, firmware version 1.1.52. Tracked as CVE-2026-90703, the flaw sits in the system function of /boafrm/formDiskCreateShare, the handler that creates a network share on router-attached USB storage, and can be triggered remotely without authentication.

This is one of two related OS command injection flaws disclosed in DWR-M921 firmware on the same day — see also CVE-2026-90702, which affects the disk format handler.

Technical Details

How It Works

The formDiskCreateShare endpoint accepts a folderpath parameter naming the directory on attached USB storage to expose as a network share. That value is passed directly into a system() call without sanitization, so an attacker who embeds shell metacharacters in folderpath can run arbitrary commands with the privileges of the disk-sharing process.

Impact Assessment

The DWR-M921 exposes built-in USB/NAS-style storage sharing, a feature commonly left enabled and reachable on the LAN — and in poorly segmented deployments, the internet. A successful exploit yields command execution as the router's storage-management process, which typically has access to attached storage, the filesystem, and the network stack.

Potential Attack Chains

1. Attacker reaches the router's web management interface, directly if internet-exposed or from an adjacent LAN segment.
2. A crafted folderpath value containing shell metacharacters is submitted to formDiskCreateShare.
3. Injected commands execute with the router's storage-process privileges.
4. The compromised device is used to exfiltrate data from attached storage, pivot into the LAN, or is conscripted into an IoT botnet.

Mitigation

• Check D-Link's support portal for a firmware update addressing CVE-2026-90703 and apply it as soon as one is released — no patched firmware was referenced in the disclosure at time of writing.
• Never expose router management interfaces to the internet. Restrict access to formDiskCreateShare and other admin endpoints to trusted internal networks or a management VLAN.
• Disable USB storage sharing on the router if the feature is not actively required.
• Segment routers with attached storage away from sensitive internal systems to limit blast radius if the device is compromised.
• Consider replacing end-of-support D-Link hardware with actively patched alternatives in environments with elevated security requirements.

References

• NVD — CVE-2026-90703
• CISA Known Exploited Vulnerabilities Catalog