CVE-2026-10878

🗓️ 05 Jun 2026 00:00:17Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 20 Views🌐 WEB

CVE-2026-10878 affects D-Link DWR-M920 remote command injection via formSmsManage action_value.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-10878	5 Jun 202600:00	–	attackerkb
CNNVD	D-Link DWR-M920 命令注入漏洞	5 Jun 202600:00	–	cnnvd
Cvelist	CVE-2026-10878 D-Link DWR-M920 formSmsManage sub_41C8E8 command injection	5 Jun 202600:00	–	cvelist
EUVD	EUVD-2026-34775	5 Jun 202600:00	–	euvd
NVD	CVE-2026-10878	5 Jun 202600:16	–	nvd
Positive Technologies	PT-2026-46838	5 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-10878	6 Jun 202600:44	–	redhatcve
Vulnrichment	CVE-2026-10878 D-Link DWR-M920 formSmsManage sub_41C8E8 command injection	5 Jun 202600:00	–	vulnrichment

NVD

Vulners

Node

dlink dwr-m920_firmwareMatch1.1.50

dlink dwr-m920_firmwareMatch1.1.70

AND

dlink dwr-m920Match-

[
  {
    "vendor": "D-Link",
    "product": "DWR-M920",
    "versions": [
      {
        "version": "1.1.50",
        "status": "affected"
      },
      {
        "version": "1.1.70",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:h:d-link:dwr-m920:*:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
dlink	www.dlink.com/
vuldb	www.vuldb.com/vuln/368368
vuldb	www.vuldb.com/vuln/368368/cti
vuldb	www.vuldb.com/submit/832154
github	www.github.com/7u7777/Dlink/blob/DWR-M920/formSmsManage.md
vuldb	www.vuldb.com/cve/CVE-2026-10878

Parameter	Position	Path	Description	CWE
action_value	request body	/boafrm/formSmsManage	Remote command injection via manipulation of action_value parameter in formSmsManage	CWE-74, CWE-77

17 Jun 2026 10:12Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.16.3 - 8.8

CVSS 45.3

CVSS 26.5

CVSS 36.3

EPSS0.04236

SSVC