CVE-2025-15192 | D-Link DWR-M920 up to 1.1.50 formLtefotaUpgradeQuectel sub_415328 fota_url command injection

A vulnerability classified as critical was found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection.

This vulnerability is documented as CVE-2025-15192. The attack can be executed remotely. Additionally, an exploit exists.