CVE-2026-11339
Full vulnerability record from the local CVENow database.
Description
A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Severity
LOW
CVSS score
2.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-05 17:16:46.193000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-11339",
"sourceIdentifier": "[email protected]",
"published": "2026-06-05T17:16:46.193",
"lastModified": "2026-10-26T11:10:00.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used."
},
{
"lang": "es",
"value": "Se detectó una vulnerabilidad en D-Link DWR-M920 hasta la versión 1.1.50. El elemento afectado es la función sub_41CF20 del archivo /boafrm/formUSSDSetup. La manipulación del argumento ussdValue resulta en inyección de comandos. Es posible lanzar el ataque remotamente. El exploit ya es público y puede ser utilizado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "D-Link",
"product": "DWR-M920",
"cpes": [
"cpe:2.3:h:d-link:dwr-m920:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "1.1.0",
"status": "affected"
},
{
"version": "1.1.1",
"status": "affected"
},
{
"version": "1.1.2",
"status": "affected"
},
{
"version": "1.1.3",
"status": "affected"
},
{
"version": "1.1.4",
"status": "affected"
},
{
"version": "1.1.5",
"status": "affected"
},
{
"version": "1.1.6",
"status": "affected"
},
{
"version": "1.1.7",
"status": "affected"
},
{
"version": "1.1.8",
"status": "affected"
},
{
"version": "1.1.9",
"status": "affected"
},
{
"version": "1.1.10",
"status": "affected"
},
{
"version": "1.1.11",
"status": "affected"
},
{
"version": "1.1.12",
"status": "affected"
},
{
"version": "1.1.13",
"status": "affected"
},
{
"version": "1.1.14",
"status": "affected"
},
{
"version": "1.1.15",
"status": "affected"
},
{
"version": "1.1.16",
"status": "affected"
},
{
"version": "1.1.17",
"status": "affected"
},
{
"version": "1.1.18",
"status": "affected"
},
{
"version": "1.1.19",
"status": "affected"
},
{
"version": "1.1.20",
"status": "affected"
},
{
"version": "1.1.21",
"status": "affected"
},
{
"version": "1.1.22",
"status": "affected"
},
{
"version": "1.1.23",
"status": "affected"
},
{
"version": "1.1.24",
"status": "affected"
},
{
"version": "1.1.25",
"status": "affected"
},
{
"version": "1.1.26",
"status": "affected"
},
{
"version": "1.1.27",
"status": "affected"
},
{
"version": "1.1.28",
"status": "affected"
},
{
"version": "1.1.29",
"status": "affected"
},
{
"version": "1.1.30",
"status": "affected"
},
{
"version": "1.1.31",
"status": "affected"
},
{
"version": "1.1.32",
"status": "affected"
},
{
"version": "1.1.33",
"status": "affected"
},
{
"version": "1.1.34",
"status": "affected"
},
{
"version": "1.1.35",
"status": "affected"
},
{
"version": "1.1.36",
"status": "affected"
},
{
"version": "1.1.37",
"status": "affected"
},
{
"version": "1.1.38",
"status": "affected"
},
{
"version": "1.1.39",
"status": "affected"
},
{
"version": "1.1.40",
"status": "affected"
},
{
"version": "1.1.41",
"status": "affected"
},
{
"version": "1.1.42",
"status": "affected"
},
{
"version": "1.1.43",
"status": "affected"
},
{
"version": "1.1.44",
"status": "affected"
},
{
"version": "1.1.45",
"status": "affected"
},
{
"version": "1.1.46",
"status": "affected"
},
{
"version": "1.1.47",
"status": "affected"
},
{
"version": "1.1.48",
"status": "affected"
},
{
"version": "1.1.49",
"status": "affected"
},
{
"version": "1.1.50",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-09T14:10:32.759390Z",
"id": "CVE-2026-11339",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-74"
},
{
"lang": "en",
"value": "CWE-77"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:dlink:dwr-m920_firmware:1.1.50:*:*:*:*:*:*:*",
"matchCriteriaId": "2C932664-064A-41BC-92E2-174EB65427C6"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:dlink:dwr-m920:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E815EF72-10FC-43A4-84A7-A25ABE7A4640"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/7u7777/Dlink/blob/DWR-M920/formUSSDSetup.md",
"source": "[email protected]",
"tags": [
"Exploit",
"Mitigation",
"Third Party Advisory"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-11339",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/submit/832579",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/vuln/368881",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/vuln/368881/cti",
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
},
{
"url": "https://www.dlink.com/",
"source": "[email protected]",
"tags": [
"Product"
]
}
]
}