CVE-2026-71947
CriticalCVSS 9.8Summary
D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.
Risk Assessment
An attacker can gain full control of the device, potentially compromising network confidentiality and integrity.
Recommendation
Update the device firmware to version 1.1.5_C1_202607071108 or later if available.
Original NVD description (English source)
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.