CVE-2026-2168
Published: 08 February 2026
Summary
CVE-2026-2168 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dwr-M921 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in exposed router web form directly enables remote exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).
NVD Description
A flaw has been found in D-Link DWR-M921 1.1.50. This affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. It is possible to initiate the attack remotely. The exploit has been published…
more
and may be used.
Deeper analysisAI
CVE-2026-2168 is a command injection vulnerability (CWE-74, CWE-77) affecting the D-Link DWR-M921 router on firmware version 1.1.50. The issue lies in the function sub_419920 within the file /boafrm/formLtefotaUpgradeQuectel, where manipulation of the fota_url argument enables attackers to inject and execute arbitrary commands. Published on 2026-02-08, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability is remotely exploitable over the network with low attack complexity and no user interaction required, but it necessitates low privileges such as an authenticated account. Attackers can achieve limited impacts, including partial disclosure of sensitive information, minor data modification, and partial denial of service. An exploit has been publicly released, facilitating potential widespread abuse.
Mitigation guidance and further details are available in advisories at https://vuldb.com/?ctiid.344870, https://vuldb.com/?id.344870, https://vuldb.com/?submit.748838, the GitHub issue https://github.com/LX-66-LX/cve-new/issues/2, and the D-Link website https://www.dlink.com/.
Details
- CWE(s)