CVE-2026-71945
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.
Risk Assessment
The risk for the organization is full remote takeover of the device, potentially leading to network compromise and exposure of sensitive data.
Recommendation
Immediately update the firmware of D-Link DWR-M961 devices to version 1.1.5_C1_202607071108 or later, and restrict access to the management interface to trusted networks only.
Other vulnerabilities in D-Link DWR-M961
See all- CVE-2026-71958Critical
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can send overly long strings to the test4, ssid2, and username fields to execute arbitrary commands or cause a device crash.
- CVE-2026-71957Critical
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a buffer overflow vulnerability in the app.cgi interface. A remote attacker can send an overly long string to the netAcc.addlist[].name field to execute arbitrary commands or cause a device crash.
- CVE-2026-71956Critical
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.
- CVE-2026-71955Critical
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges.
- CVE-2026-71954Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.
- CVE-2026-71953Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.
- CVE-2026-71952Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges.
- CVE-2026-71951Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.
- CVE-2026-71950Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.
- CVE-2026-71949Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.
Original NVD description (English source)
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.