Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

D-Link DWR-M961 Devices at Risk of Remote Attack

CVE-2026-71950 · published 27 days ago
Summary

D-Link DWR-M961 devices with older firmware are vulnerable to a remote attack. An attacker could inject malicious commands, potentially gaining control of the device. Update to the latest firmware version to fix this issue.

What to do
  • Update d-link corporation dwr-m961 to version 1.1.5_C1_202607071108 or later.
Affected software
VendorProductAffected versions
d-link corporation dwr-m961 < 1.1.5_C1_202607071108
Original advisory text
D-Link DWR-M961 Command Injection via /boafrm/formSmsManage
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.
References
Severity
9.3 Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS 2%
Type
CWE-78OS Command Injection
Timeline
Published8 Aug 2026
Updated30 Aug 2026
First seen8 Aug 2026
Sources
CVE-2026-71950 · NVD
CVE-2026-71950 · MITRE
Monitor software like this
Free during beta