This vulnerability affects D-Link DWR-M920 devices running firmware versions up to 1.1.50. The issue is located in the function sub_412DA0 of the /boafrm/formIMEISetup endpoint, where improper handling of the IMEI_value parameter enables OS command injection. This allows a remote attacker to execute arbitrary OS commands on the affected device. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. Exploit code has been published, but no active exploitation is currently reported.

Successful exploitation of this vulnerability could allow a remote attacker with low privileges to execute arbitrary operating system commands on the affected D-Link DWR-M920 device. This could lead to unauthorized control or disruption of the device's normal operations. However, the impact is limited by the medium severity rating and the requirement for some level of privilege. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level has been provided, users should monitor D-Link's official channels for updates. Until a fix is available, restricting remote access to the device's management interface and applying network-level controls to limit exposure may reduce risk.