CVE-2026-71958
CriticalCVSS 9.8Summary
D-Link DWR-M961 devices (hardware C1, software 1.1.2_C1_202602110044) have a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can send overly long strings to the test4, ssid2, and username fields to execute arbitrary commands or cause a device crash.
Risk Assessment
An attacker can achieve remote code execution on the device or cause denial of service, potentially disrupting network operations.
Recommendation
Apply available firmware updates from the vendor. If not available, restrict access to the management interface and monitor for unusual traffic.
Original NVD description (English source)
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.