CVE-2026-71949 Details
Description
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.
A command injection vulnerability has been identified in the D-Link DWR-M961 router, specifically in hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. The vulnerability exists within the '/boafrm/formUSSDSetup' interface, where a remote attacker can inject arbitrary commands into the 'ussdValue' and 'selectMenuValue' fields. This exploitation allows for command execution with root privileges on the device.
Users with a D-Link DWR-M961 hardware revision C1 should update to firmware version 1.1.5_C1_202607071108 or later. The firmware can be downloaded from the D-Link support resource for this device.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 8, 2026CISA-ADP
Assessed Aug 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| D-Link DWR-M961 | <= 1.1.2_C1_202602110044 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | CISA-ADP |
| Aug 8, 2026 | CVE Modified | [email protected] |
| Aug 8, 2026 | New CVE Received | [email protected] |