An authenticated remote command injection vulnerability in D-Link DWR-M920 firmware version 1.1.7 allows attackers to execute arbitrary commands with root privileges.

This is an OS command injection vulnerability (CWE-78) occurring in the sub_41E60C function. An attacker with an authenticated session can inject shell metacharacters into the newPin parameter to break out of a system command string, resulting in arbitrary code execution as root.

The potential for unauthorized remote command execution as root poses a critical risk to business continuity and data integrity. With a CVSS score of 9.9, this vulnerability allows an attacker to fully compromise the device, intercept network traffic, or pivot into internal infrastructure, leading to significant reputational and operational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the web management interface to trusted management networks only and disable remote management features.

Proactive Monitoring: Review web access logs for unusual POST requests to the /boafrm/formPinManageSetup endpoint, particularly those containing shell metacharacters like semicolons or pipe symbols.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block traffic to /boafrm/formPinManageSetup that includes non-numeric characters in the newPin field.

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's technical write-up provided by the vulnerability submission.

Given the critical severity of this OS command injection flaw, immediate action is required to isolate affected devices from untrusted network segments. Organizations should prioritize hardening the administrative interface and monitor for any signs of exploitation until D-Link releases a firmware update that properly sanitizes the newPin parameter.