CVE-2025-15191

A weakness has been identified in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_4155B4 of the file /boafrm/formLtefotaUpgradeFibocom. This manipulation of the argument fota_url causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

• CWE-74
• CWE-77

• https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeFibocom.mdExploit, Third Party Advisory
• https://github.com/panda666-888/vuls/blob/main/d-link/dwr-m920/formLtefotaUpgradeFibocom.md#pocExploit, Third Party Advisory
• https://vuldb.com/?ctiid.338576Permissions Required, VDB Entry
• https://vuldb.com/?id.338576Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.723554Third Party Advisory, VDB Entry
• https://www.dlink.com/Product

Published

Dec 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15185A flaw has been found in code-projects Refugee Food Manageme…9.8
• CVE-2025-15186A vulnerability has been found in code-projects Refugee Food…9.8
• CVE-2025-15187A vulnerability was found in GreenCMS up to 2.3. This affect…6.5
• CVE-2025-15188A vulnerability was determined in Campcodes Complete Online …4.8
• CVE-2025-15189A vulnerability was identified in D-Link DWR-M920 up to 1.1.…8.8
• CVE-2025-15190A security flaw has been discovered in D-Link DWR-M920 up to…8.8
• CVE-2025-15192A security vulnerability has been detected in D-Link DWR-M92…8.8
• CVE-2025-15193A vulnerability was detected in D-Link DWR-M920 up to 1.1.50…8.8
• CVE-2025-15194A vulnerability was found in D-Link DIR-600 up to 2.15WWb02.…9.8
• CVE-2025-15195A vulnerability was determined in code-projects Assessment M…9.8
• CVE-2025-15196A vulnerability was identified in code-projects Assessment M…9.8
• CVE-2025-15197A security flaw has been discovered in code-projects/anirban…7.2