CVE-2026-71948 Details
Description
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
A command injection vulnerability has been identified in the D-Link DWR-M961 router, specifically in hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. The vulnerability exists within the web-management CGI component, in the formDebugDiagnosticRun interface. This issue allows remote attackers to inject arbitrary commands into the host field, which are then executed with root privileges on the device.
Users with a D-Link DWR-M961 hardware revision C1 should update to firmware version 1.1.5_C1_202607071108 or later. After updating, verify that the device's administration interface displays the new firmware version. The DWR-M961 is a non-US product, and update procedures may vary by region.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 8, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| D-Link DWR-M961 | <= 1.1.2_C1_202602110044 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 8, 2026 | CVE Modified | [email protected] |
| Aug 8, 2026 | New CVE Received | [email protected] |