CVE-2026-10878: D-Link DWR-M920 formSmsManage sub_41C8E8 command injection
A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument actionvalue results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the SMS management endpoint /boafrm/formSmsManage or the SMS management feature in the device configuration. If the device doesn't provide per-endpoint controls, disable SMS management functionality entirely until a vendor fix is available.
D-Link DWR-M920 web interface (/boafrm/formSmsManage) access to /boafrm/formSmsManage (SMS management) = disabled or restricted - Compensating control
Block or filter access to /boafrm/formSmsManage at the network perimeter or WAF. Restrict device management access to trusted IPs or via an administrative VPN and deny management access from untrusted networks (e.g., the internet).
- Operational
Isolate affected D-Link DWR-M920 devices from untrusted networks until mitigations or a vendor firmware update is applied.
- Operational
Monitor device logs and network traffic for attempts to access /boafrm/formSmsManage or other indicators of exploitation; investigate any suspicious activity.
- Operational
Rotate administrator and device credentials if the device has been reachable by untrusted networks or may have been exposed.
- Operational
Apply any vendor-supplied firmware updates or advisories for the D-Link DWR-M920 as soon as they are released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10878?
The severity of CVE-2026-10878 is classified as low with a score of 2.1.
How do I fix CVE-2026-10878?
To fix CVE-2026-10878, update the D-Link DWR-M920 firmware to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-10878?
CVE-2026-10878 is classified as a command injection vulnerability.
Can CVE-2026-10878 be exploited remotely?
Yes, CVE-2026-10878 can be exploited remotely due to the nature of the vulnerability.
Which software is affected by CVE-2026-10878?
The affected software for CVE-2026-10878 is D-Link DWR-M920 versions 1.1.50 and 1.1.70.