CVE-2026-71953

CriticalCVSS 9.8

Published: 08/08/2026(UTC)Translated: 08/08/2026(UTC)NVD NIST

Summary

D-Link DWR-M961 devices (hardware version C1, firmware before 1.1.5_C1_202607071108) contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.

Risk Assessment

An attacker can gain full control of the device, potentially compromising network confidentiality and integrity.

Recommendation

Update the device firmware to version 1.1.5_C1_202607071108 or later if available.

Original NVD description (English source)

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.