This vulnerability affects D-Link DWR-M921 firmware version 1.1.52. It arises from improper sanitization of the folderpath parameter passed to the system function in /boafrm/formDiskCreateShare, enabling remote OS command injection. The vulnerability allows an attacker with network access to execute arbitrary commands on the device with elevated privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, availability, and security scope. Public exploit details have been disclosed, but no confirmed exploitation in the wild is known.

Successful exploitation can lead to full compromise of the affected device, allowing attackers to execute arbitrary operating system commands remotely. This can result in unauthorized control, data theft, disruption of service, or further network compromise. The vulnerability is critical due to its remote attack vector and high impact on device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device, especially from untrusted networks. Monitor for unusual activity related to the /boafrm/formDiskCreateShare endpoint. Follow vendor communications closely for updates on patches or mitigations.