CVE-2026-2085

CWE-74CWE-77 — Command Injection3 documents3 sources
Severity
7.3HIGH
EPSS
0.5%
top 35.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
D-link Dwr-m921Dlink Dwr-m921 Firmware
Timeline
PublishedFeb 7

Description

A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component USSD Configuration Endpoint. The manipulation of the argument ussdValue leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5d-link/dwr-m9211.1.50

🔴Vulnerability Details

2
GHSA
GHSA-377q-fc84-7fvf: A security vulnerability has been detected in D-Link DWR-M921 1↗2026-02-07
▶
CVEList
D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injection↗2026-02-07
▶
CVE-2026-2085 (HIGH CVSS 7.3) | A security vulnerability has been d | cvebase.io