CVE-2026-71944
CriticalCVSS 9.8Summary
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.
Risk Assessment
The risk for the organization is full remote takeover of the device, potentially leading to network compromise and exposure of sensitive data.
Recommendation
Immediately update the firmware of D-Link DWR-M961 devices to version 1.1.5_C1_202607071108 or later, and restrict access to the management interface to trusted networks only.
Original NVD description (English source)
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.