A critical command injection vulnerability in the D-Link DWR-M921 router allows remote attackers with administrative privileges to execute arbitrary system commands, posing a significant risk of full device compromise.

This flaw is a command injection vulnerability (CWE-77) located in the sub_419F20 function within the /boafrm/formUSSDSetup file. An authenticated attacker with administrative privileges can manipulate the ussdValue argument to achieve remote command execution.

The ability to execute arbitrary commands on a network device allows an attacker to gain full control over the gateway, potentially leading to total network interception, unauthorized data access, or the repurposing of the device for botnet activities. Given the CVSS score of 7.2, this vulnerability represents a high risk to organizational network integrity. Successful exploitation could result in significant operational disruption and the compromise of internal communications.

Immediate Action: As no official patch is currently identified, administrators should immediately restrict administrative access to the device management interface to trusted internal IP addresses only. Disable the USSD functionality if it is not required for daily operations to eliminate the attack vector.

Proactive Monitoring: Monitor device access logs for suspicious administrative activity and unusual patterns in USSD-related configuration requests. Review system logs for unexpected process execution or unauthorized configuration changes.

Compensating Controls: Implement strict firewall rules to block external access to the device web management interface. Utilize a Web Application Firewall (WAF) or network-based IDS to detect and block malicious payloads targeting the /boafrm/formUSSDSetup endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the high potential impact of command injection, this vulnerability must be treated with urgency. Administrators should prioritize isolating affected D-Link DWR-M921 units from external networks and monitor vendor channels for the release of a firmware update. Failure to mitigate this exposure could lead to complete device takeover by malicious actors.