CVE-2026-10878

The CVE concerns D-Link DWR-M920 firmware versions 1.1.50/1.1.70. The vulnerability is in the function sub_41C8E8 of /boafrm/formSmsManage, where manipulating the action_value argument results in a command injection. It is exploitable remotely, and the exploit is publicly available. No remediatio...

D-Link DWR-M961 has a command injection vulnerability

The D-Link DWR-M961 is a router produced by D-Link Corporation. Version 1.1.47 of the D-Link DWR-M961 contains a command injection vulnerability. This vulnerability arises from incorrect operations on the parameter actionvalue in the file /boafrm/formSmsManage, which may lead to command injection...