CVE-2026-71945 in DWR-M961
Summary
by MITRE • 08/08/2026
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/08/2026
The D-Link DWR-M961 device represents a category of 4G LTE routers commonly deployed in enterprise and industrial environments for connectivity management. These devices operate as critical network infrastructure components that handle various administrative functions including firmware updates, network configuration, and remote management capabilities. The specific hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 contain a significant security flaw that affects the web-based administration interface of these devices. This vulnerability manifests within the /boafrm/formLtefotaUpgradeFibocom endpoint which is responsible for handling firmware over-the-air upgrade requests for the Fibocom cellular module.
The technical exploitation of this vulnerability stems from improper input validation and sanitization within the fota_url parameter processing logic. When a remote attacker submits malicious input through the fota_url field, the device fails to properly escape or validate user-supplied data before incorporating it into system commands. This creates an arbitrary command injection scenario where attacker-controlled commands can be executed with the highest privileges available on the system. The vulnerability is particularly dangerous because it allows execution with root privileges, which means attackers can gain complete control over the device's operating system and all its functionalities.
The operational impact of this command injection vulnerability extends beyond simple unauthorized access to encompass full system compromise and potential network infiltration. An attacker who successfully exploits this vulnerability can execute arbitrary code on the device, potentially leading to persistent backdoor installation, data exfiltration, or use of the compromised device as a pivot point for attacking other systems within the local network. The remote nature of the attack means that no physical access or local network presence is required to exploit this vulnerability, making it particularly attractive to threat actors seeking low-effort high-impact attacks. This vulnerability directly maps to CWE-77 and CWE-94 in the Common Weakness Enumeration catalog, which categorizes it as a command injection flaw resulting from insufficient input validation.
Security professionals should immediately implement mitigations including firmware updates to version 1.1.5_C1_202607071108 or later, which contain proper input validation and sanitization measures for the affected interface. Network segmentation should be implemented to limit access to these devices to authorized administrative networks only, while also deploying network monitoring solutions that can detect unusual command execution patterns on these devices. Additional protective measures include disabling unnecessary web administration interfaces when not required, implementing strong authentication mechanisms with multi-factor authentication, and regularly auditing device configurations for unauthorized changes. Organizations should consider this vulnerability in their threat modeling processes and update their incident response procedures to address potential exploitation attempts targeting these specific device models.
The attack surface of this vulnerability aligns with several MITRE ATT&CK framework techniques including T1059.001 for command and scripting interpreter, T1021.001 for remote services, and T1078.004 for valid accounts. The exploitation process typically involves crafting malicious payloads that bypass the device's authentication mechanisms and inject commands through the vulnerable web interface. Given the nature of industrial control systems and network infrastructure devices, this vulnerability could potentially be leveraged in supply chain attacks or targeted campaigns against critical infrastructure sectors where such devices are commonly deployed. Organizations should also consider implementing network access controls at the firewall level to restrict direct access to these administrative interfaces from untrusted networks while maintaining necessary remote management capabilities through secure channels.