CVE-2026-71944 Details
Description
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.
A command injection vulnerability has been identified in the D-Link DWR-M961 router, specifically in devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. The vulnerability exists within the web management interface, particularly in the formLtefotaUpgradeQuectel component. This issue allows remote attackers to inject arbitrary commands into the fota_url field, which are then executed with root privileges on the device.
Users with a D-Link DWR-M961 hardware revision C1 should update to firmware version 1.1.5_C1_202607071108 or later. The firmware can be downloaded from the D-Link support resource for this model.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 8, 2026CISA-ADP
Assessed Aug 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 | [email protected] | AdvisoryBundleRemedyVendor |
| https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/d-link-dwr-m961-command-injection-via-boafrm-formltefotaupgradequectel | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| D-Link DWR-M961 | < 1.1.5_C1_202607071108 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | CISA-ADP |
| Aug 8, 2026 | New CVE Received | [email protected] |