The 8.8 CVSS score on this command injection flaw warrants scrutiny. Command injection vulnerabilities in unauthenticated remote contexts routinely hit 9.8 under CVSS's current formula — the gap to 8.8 implies either authentication gating, adjacency constraints, or scope limitations that defenders must map precisely before accepting the severity at face value.
The vulnerable handler /boafrm/formUSSDSetup sits on D-Link's Boa webserver, a common architecture in DWR-M920 and similar consumer devices. The 'ussdValue' parameter reveals integrated cellular modem functionality — USSD is a GSM protocol for interactive sessions, which expands the attack surface in ways users wouldn't expect from a WiFi router. Command injection here means arbitrary shell execution as the firmware's privileged user, not a sandboxed context.
The scoring gap almost certainly reflects an Adjacent vector — the web interface is LAN-facing, not internet-direct. But this creates a dangerous illusion of containment. Consumer networks have almost no segmentation; an attacker who compromises any device on the home network (a compromised IoT camera, malicious app, smart TV) immediately has adjacency to the router. Every IoT botnet already has agents capable of proxying HTTP requests to the router's management interface. The 'Adjacent' distinction that CVSS treats as meaningful is functionally meaningless in environments where thousands of compromised devices already serve as hop points.
The USSD angle compounds the risk. Carriers largely abandoned USSD in the early 2010s in favor of IMS and secure SMS — they no longer fuzz, audit, or update handlers for it. The USSD handler in formUSSDSetup is effectively sedimented code: deposited years ago, never touched since, and running atop a deprecated baseband stack that likely received no security patching. This isn't just a command injection — it's command injection in forgotten code with no active maintenance.
The exploit being public against firmware up to version 1.1.50 suggests this is a legacy flaw now weaponized. The practical attack path hinges on authentication: if the handler requires auth, the question becomes whether default credentials persist on DWR-M920 or whether session hijacking is feasible. The alternative — that adjacency is the only barrier — means any compromised device on the local network can execute commands on the router.
Defenders should treat this as a high-severity issue regardless of the 8.8 score. Prioritize identifying whether the web interface is exposed, auditing for default credentials, and assuming the USSD handler has received no security updates since the product shipped. For end-of-life consumer routers, expect no patch — segment these devices and monitor for indicators of compromise rather than waiting for remediation.