This vulnerability affects D-Link DWR-M920 devices running firmware versions 1.1.50 and 1.1.70. It involves a command injection flaw in the sub_41C8E8 function of the /boafrm/formSmsManage endpoint. By manipulating the action_value parameter, an attacker can remotely execute arbitrary commands on the device. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official patch or mitigation has been disclosed by D-Link.

Successful exploitation allows remote attackers to execute arbitrary commands on affected D-Link DWR-M920 devices, potentially compromising device integrity and control. The impact is rated medium with limited confidentiality, integrity, and availability impact according to the CVSS 4.0 vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting remote access to the affected device's management interfaces to trusted networks only. Monitor vendor channels for updates and apply patches promptly once available.