Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

D-Link DWR-M961 Firmware Command Injection Risk

CVE-2026-71944 · published 27 days ago
Summary

D-Link DWR-M961 routers with outdated firmware are at risk of being taken over by hackers. This is because an attacker can inject malicious commands into the router's software, giving them full control. D-Link recommends updating the firmware to version 1.1.5_C1_202607071108 or later to fix this issue.

What to do
  • Update d-link corporation dwr-m961 to version 1.1.5_C1_202607071108 or later.
Affected software
VendorProductAffected versions
d-link corporation dwr-m961 < 1.1.5_C1_202607071108
Original advisory text
D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.
References
Severity
9.3 Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS 2%
Type
CWE-78OS Command Injection
Timeline
Published8 Aug 2026
Updated30 Aug 2026
First seen8 Aug 2026
Sources
CVE-2026-71944 · NVD
CVE-2026-71944 · MITRE
Monitor software like this
Free during beta