Cyber Resilience

CVE-2026-2168

MediumPublic PoC

Published: 08 February 2026

Published
08 February 2026
Modified
11 February 2026
KEV Added
Patch
CVSS Score v4 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0296 85.4th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-2168 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dwr-M921 Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2026-2168 is a command injection vulnerability (CWE-74, CWE-77) affecting the D-Link DWR-M921 router on firmware version 1.1.50. The issue lies in the function sub_419920 within the file /boafrm/formLtefotaUpgradeQuectel, where manipulation of the fota_url argument enables attackers to inject and execute arbitrary commands. Published on 2026-02-08, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

The vulnerability is remotely exploitable over the network with low attack complexity and no user interaction required, but it necessitates low privileges such as an authenticated account. Attackers can achieve limited impacts, including partial disclosure of sensitive information, minor data modification, and partial denial of service. An exploit has been publicly released, facilitating potential widespread abuse.

Mitigation guidance and further details are available in advisories at https://vuldb.com/?ctiid.344870, https://vuldb.com/?id.344870, https://vuldb.com/?submit.748838, the GitHub issue https://github.com/LX-66-LX/cve-new/issues/2, and the D-Link website https://www.dlink.com/.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A flaw has been found in D-Link DWR-M921 1.1.50. This affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. It is possible to initiate the attack remotely. The exploit has been published…

more

and may be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command injection in exposed router web form directly enables remote exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-2085Same product: Dlink Dwr-M921
CVE-2026-2169Same product: Dlink Dwr-M921
CVE-2026-1624Same vendor: Dlink
CVE-2026-4204Same vendor: Dlink
CVE-2026-8345Same vendor: Dlink
CVE-2026-4197Same vendor: Dlink
CVE-2026-4195Same vendor: Dlink
CVE-2026-1419Same vendor: Dlink
CVE-2026-4206Same vendor: Dlink
CVE-2025-1800Same vendor: Dlink

Affected Assets

dlink
dwr-m921 firmware
1.1.50

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of the fota_url argument before it reaches sub_419920, blocking command injection at the root cause.

prevent

Enforces that only properly mediated and authorized inputs are accepted by the formLtefotaUpgradeQuectel handler, limiting what an authenticated session can execute.

prevent

Restricts enabling or exposing the vulnerable FOTA upgrade function unless explicitly required, reducing the attack surface of the web management interface.

References