CVE-2026-71950 Details
Description
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.
A command injection vulnerability has been identified in the D-Link DWR-M961 router, specifically in hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. The vulnerability exists within the web management interface, particularly in the '/boafrm/formSmsManage' handler, where remote attackers can inject arbitrary commands into the 'action_value' field. This injection allows for command execution with root privileges on the device.
Users should update to D-Link DWR-M961 firmware version 1.1.5_C1_202607071108 or later. The firmware can be downloaded from the D-Link support website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 8, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| D-Link DWR-M961 | <= 1.1.2_C1_202602110044 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 8, 2026 | CVE Modified | [email protected] |
| Aug 8, 2026 | New CVE Received | [email protected] |