CVE-2026-10878 Details
Description
A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub_41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument action_value results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A command injection vulnerability has been identified in the D-Link DWR-M920 router, specifically in versions 1.1.50 and 1.1.70. The issue arises in the '/boafrm/formSmsManage' route, where the 'action_value' parameter can be manipulated. The vulnerability allows for remote exploitation, with the details of the exploit now publicly available.
Users are advised to avoid passing untrusted input directly to system functions. Instead, validate and sanitize input parameters to remove any potentially harmful characters or commands. If possible, use safer alternatives to execute commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/7u7777/Dlink/blob/DWR-M920/formSmsManage.md | [email protected] | ExploitThird Party Advisory |
| https://vuldb.com/cve/CVE-2026-10878 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/submit/832154 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/368368 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/368368/cti | [email protected] | Permissions RequiredVDB Entry |
| https://www.dlink.com/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dlink dwr-m920 firmware | 1.1.50 1.1.70 |
CPE
Remediation
| |
| dlink dwr-m920 | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| Jun 5, 2026 | New CVE Received | [email protected] |