Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-71951: D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup

CVE-2026-71951 · published 27 days ago

Summary

D-Link DWR-M961 devices are at risk of being controlled by hackers. This is because a hacker can inject malicious commands into the device, which can then be executed with full control. To protect your device, update to firmware version 1.1.5_C1_202607071108 or later.

What to do

Update d-link corporation dwr-m961 to version 1.1.5_C1_202607071108 or later.

Affected software

Vendor	Product	Affected versions
d-link corporation	dwr-m961	< 1.1.5_C1_202607071108

Original advisory text

D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.

References

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 vendor-advisory patch
https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router product
https://www.vulncheck.com/advisories/d-link-dwr-m961-command-injection-via-boafr... third-party-advisory

Severity

9.3 Critical

CVSS 3.1: 9.8 (MITRE)

Exploitation

EPSS 2%

Type

CWE-78OS Command Injection

Timeline

Published8 Aug 2026

Updated30 Aug 2026

First seen8 Aug 2026

Sources

CVE-2026-71951 · NVD

CVE-2026-71951 · MITRE

Monitor software like this

Free during beta