Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-71948: D-Link DWR-M961 Devices at Risk of Remote Command Execution

CVE-2026-71948 · published 27 days ago

Summary

D-Link DWR-M961 devices with older firmware are vulnerable to remote attacks. An attacker could inject malicious commands and gain full control of the device. Update the firmware to the latest version to fix this vulnerability.

What to do

Update d-link corporation dwr-m961 to version 1.1.5_C1_202607071108 or later.

Affected software

Vendor	Product	Affected versions
d-link corporation	dwr-m961	< 1.1.5_C1_202607071108

Original advisory text

D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.

References

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 vendor-advisory patch
https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router product
https://www.vulncheck.com/advisories/d-link-dwr-m961-command-injection-via-boafr... third-party-advisory

Severity

9.3 Critical

CVSS 3.1: 9.8 (MITRE)

Exploitation

EPSS 2%

Type

CWE-78OS Command Injection

Timeline

Published8 Aug 2026

Updated30 Aug 2026

First seen8 Aug 2026

Sources

CVE-2026-71948 · NVD

CVE-2026-71948 · MITRE

Monitor software like this

Free during beta