D-Link Dwr-m920 vulnerabilities

2 CVEs affecting D-Link Dwr-m920, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-90699, published 2026-09-14.

More from D-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-90699, published 2026-09-14. Critical severity, CVSS 9.9. EPSS: 3.3% chance of exploitation in the next 30 days. A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command…
• CVE-2026-11341, published 2026-06-05. Medium severity, CVSS 6.3. EPSS: 1% chance of exploitation in the next 30 days. A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI_value causes os…