Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-71945: D-Link DWR-M961 Command Injection via Firmware Upgrade

CVE-2026-71945 · published 27 days ago

Summary

D-Link DWR-M961 devices with outdated firmware are at risk of being exploited by an attacker who can inject malicious commands. This can lead to unauthorized access and control of the device. Users should update their firmware to the latest version to fix this issue.

What to do

Update d-link corporation dwr-m961 to version 1.1.5_C1_202607071108 or later.

Affected software

Vendor	Product	Affected versions
d-link corporation	dwr-m961	< 1.1.5_C1_202607071108

Original advisory text

D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.

References

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 vendor-advisory patch
https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router product
https://www.vulncheck.com/advisories/d-link-dwr-m961-command-injection-via-boafr... third-party-advisory

Severity

9.3 Critical

CVSS 3.1: 9.8 (MITRE)

Exploitation

EPSS 2%

Type

CWE-78OS Command Injection

Timeline

Published8 Aug 2026

Updated30 Aug 2026

First seen8 Aug 2026

Sources

CVE-2026-71945 · NVD

CVE-2026-71945 · MITRE

Monitor software like this

Free during beta