CVE-2026-71954 Details
Description
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.
A command injection vulnerability has been identified in the D-Link DWR-M961 router, specifically in hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. The vulnerability exists within the web-management CGI component responsible for L2TPv3 configuration. A remote attacker can exploit this issue by injecting arbitrary commands into the tunnelid and sessionid fields, which are then executed with root privileges on the device.
Users should update to D-Link DWR-M961 firmware version 1.1.5_C1_202607071108 or later. The firmware can be downloaded from the D-Link support resource for this device.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 8, 2026CISA-ADP
Assessed Aug 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| D-Link DWR-M961 | <= 1.1.2_C1_202602110044 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | CISA-ADP |
| Aug 8, 2026 | CVE Modified | [email protected] |
| Aug 8, 2026 | New CVE Received | [email protected] |