CVE-2026-71957
CriticalCVSS 9.8Summary
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a buffer overflow vulnerability in the app.cgi interface. A remote attacker can send an overly long string to the netAcc.addlist[].name field to execute arbitrary commands or cause a device crash.
Risk Assessment
Similar to other D-Link vulnerabilities, an attacker can achieve remote code execution or cause denial of service, potentially impacting network integrity.
Recommendation
Install vendor patches if available. Restrict access to the management interface and apply network segmentation.
Original NVD description (English source)
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash.