CVE-2026-2085

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in D-Link DWR-M921 1.1.50. Affected is the function sub_419F20 of the file /boafrm/formUSSDSetup of the component USSD Configuration Endpoint. The manipulation of the argument ussdValue leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208516.2Out-of-bounds read in Capability Access Management Service (camsvc) allows an unauthorized attacker to disclose information locally.CVE-2026-208527.7Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.CVE-2026-208537.4Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized CVE-2026-208547.5Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.CVE-2026-208568.1Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network.CVE-2026-208577.8Untrusted pointer dereference in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-208587.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-208597.8Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.CVE-2026-20868.8A vulnerability was detected in UTT HiPER 810G up to 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform CVE-2026-208607.8Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker CVE-2026-208617.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authori CVE-2026-208625.5Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose informat