CVE-2026-10878

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub_41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument action_value results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
D-Link	DWR-M920	1.1.50; 1.1.70

References

https://github.com/7u7777/Dlink/blob/DWR-M920/formSmsManage.mdExploit, Third Party Advisory
https://vuldb.com/cve/CVE-2026-10878Third Party Advisory, VDB Entry
https://vuldb.com/submit/832154Third Party Advisory, VDB Entry
https://vuldb.com/vuln/368368Third Party Advisory, VDB Entry
https://vuldb.com/vuln/368368/ctiPermissions Required, VDB Entry
https://www.dlink.com/Product

Timeline

Published: Jun 5, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1087806.5Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are ope CVE-2026-1087816.3A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsC CVE-2026-1087826.3A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoLi CVE-2026-1087837.3A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py o CVE-2026-1087846.5A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/m CVE-2026-1087856.3A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refre CVE-2026-1087866.3A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlO CVE-2026-1087876.3A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/cra CVE-2026-1087885.3A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component CVE-2026-1087895.5A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workfl CVE-2026-108799.8DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expand CVE-2026-1087904.7A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function Template