CVE-2026-71947
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.
Risk Assessment
An attacker can gain full control of the device, potentially compromising network confidentiality and integrity.
Recommendation
Update the device firmware to version 1.1.5_C1_202607071108 or later if available.
Other vulnerabilities in D-Link DWR-M961
See all- CVE-2026-71958Critical
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can send overly long strings to the test4, ssid2, and username fields to execute arbitrary commands or cause a device crash.
- CVE-2026-71957Critical
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a buffer overflow vulnerability in the app.cgi interface. A remote attacker can send an overly long string to the netAcc.addlist[].name field to execute arbitrary commands or cause a device crash.
- CVE-2026-71956Critical
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.
- CVE-2026-71955Critical
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges.
- CVE-2026-71954Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.
- CVE-2026-71953Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.
- CVE-2026-71952Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges.
- CVE-2026-71951Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.
- CVE-2026-71950Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.
- CVE-2026-71949Critical
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.
Original NVD description (English source)
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.