CVE detail
CVE-2025-15192
A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 19.5 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 4.5
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
6 source links · newest first
- https://www.dlink.com/www.dlink.com
No excerpt available.
Vendor Advisorywww.dlink.comDec 29, 2025, 3:16 PM - https://vuldb.com/?submit.723555vuldb.com
No excerpt available.
Exploitvuldb.comDec 29, 2025, 3:16 PM - https://vuldb.com/?id.338577vuldb.com
No excerpt available.
Exploitvuldb.comDec 29, 2025, 3:16 PM - https://vuldb.com/?ctiid.338577vuldb.com
No excerpt available.
Exploitvuldb.comDec 29, 2025, 3:16 PM - https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeQuectel.md#pocgithub.com
No excerpt available.
Exploitgithub.comDec 29, 2025, 3:16 PM - https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeQuectel.mdgithub.com
No excerpt available.
Exploitgithub.comDec 29, 2025, 3:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
1 repository references · best confidence 0.90 · max 0 stars
- panda666-888/vulsHigh confidencegithubNVD Exploit reference0 starsDiscovered Jul 25, 2026, 6:20 PM
NVD labels the source link as Exploit; this is not independent verification of the repository's code.
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-11339CVSS 2.1 · Low
A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument u…
- CVE-2026-10878CVSS 2.1 · Low
A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub_41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument act…
- CVE-2025-15191CVSS 2.1 · Low
A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of…
- CVE-2025-13306CVSS 2.1 · Low
A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formDebugDiagnosticRun. T…
- CVE-2026-19747CVSS 8.9 · High
A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the…
- CVE-2026-19348CVSS 8.9 · High
A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&fun…