Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-71947: D-Link DWR-M961: Malicious Commands Can Be Run Remotely

CVE-2026-71947 · published 27 days ago

Summary

Some D-Link DWR-M961 devices with old firmware are at risk of being controlled by hackers. This is because of a security weakness in the device's settings page. To protect your device, update to the latest firmware version.

What to do

Update d-link corporation dwr-m961 to version 1.1.5_C1_202607071108 or later.

Affected software

Vendor	Product	Affected versions
d-link corporation	dwr-m961	< 1.1.5_C1_202607071108

Original advisory text

D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.

References

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 vendor-advisory patch
https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router product
https://www.vulncheck.com/advisories/d-link-dwr-m961-command-injection-via-boafr... third-party-advisory

Severity

9.3 Critical

CVSS 3.1: 9.8 (MITRE)

Exploitation

EPSS 2%

Type

CWE-78OS Command Injection

Timeline

Published8 Aug 2026

Updated30 Aug 2026

First seen8 Aug 2026

Sources

CVE-2026-71947 · NVD

CVE-2026-71947 · MITRE

Monitor software like this

Free during beta