Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-71955: D-Link DWR-M961 Firmware Command Injection

CVE-2026-71955 · published 27 days ago

Summary

D-Link DWR-M961 routers with outdated firmware are vulnerable to malicious commands. This allows hackers to gain control of the device. Update your firmware to the latest version to fix this issue.

What to do

Update d-link corporation dwr-m961 to version 1.1.5_C1_202607071108 or later.

Affected software

Vendor	Product	Affected versions
d-link corporation	dwr-m961	< 1.1.5_C1_202607071108

Original advisory text

D-Link DWR-M961 Command Injection via /boafrm/formWsc

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges.

References

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 vendor-advisory patch
https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router product
https://www.vulncheck.com/advisories/d-link-dwr-m961-command-injection-via-boafr... third-party-advisory

Severity

9.3 Critical

CVSS 3.1: 9.8 (MITRE)

Exploitation

EPSS 2%

Type

CWE-78OS Command Injection

Timeline

Published8 Aug 2026

Updated30 Aug 2026

First seen8 Aug 2026

Sources

CVE-2026-71955 · NVD

CVE-2026-71955 · MITRE

Monitor software like this

Free during beta