CVE-2026-71946 in DWR-M961
Summary
by MITRE • 08/08/2026
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/08/2026
The D-Link DWR-M961 router series represents a line of wireless broadband routers commonly deployed in residential and small office environments. These devices operate with embedded web interfaces that manage network diagnostics and system configuration through HTTP forms. The specific vulnerability affects hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108, indicating a targeted issue within a particular product lineage where security updates were not properly implemented or distributed. This exposes a critical gap in the device's input validation mechanisms that has persisted across multiple firmware iterations.
The vulnerability manifests within the /boafrm/formPingDiagnosticRun interface, which serves as a diagnostic tool for network connectivity testing. The flaw occurs when processing user input through the host field parameter, where the application fails to properly sanitize or validate the data submitted by remote users. This represents a classic command injection vulnerability that allows an attacker to append malicious commands to legitimate network diagnostic operations. The root cause stems from improper handling of user-supplied input without adequate filtering or escaping mechanisms, directly correlating with CWE-77 which defines command injection as the execution of arbitrary commands through vulnerable input fields.
Operationally, this vulnerability enables a remote attacker to execute arbitrary code with the highest privileges available on the device, specifically root access. The implications extend far beyond simple network diagnostics since the attacker can leverage this privilege escalation to manipulate firewall rules, modify network configurations, install backdoors, or exfiltrate sensitive data from connected networks. The attack vector requires no authentication and operates over the standard HTTP interface, making it particularly dangerous as it can be exploited by anyone with network access to the device. This aligns with ATT&CK technique T1059 which covers command and scripting interpreter usage for execution.
The impact of this vulnerability creates a persistent security risk for all affected users since the exploit can remain active across device reboots and does not require physical access or specialized tools beyond standard network reconnaissance. Network administrators must consider that compromised devices could serve as entry points for broader attacks within connected networks, potentially enabling lateral movement to other systems. Mitigation strategies include immediate firmware updates to version 1.1.5_C1_202607071108 or later, which should contain proper input validation and sanitization of the host parameter field. Additionally, network segmentation and firewall rules should be implemented to restrict access to administrative interfaces from untrusted networks, while monitoring for unusual diagnostic activity patterns that might indicate exploitation attempts.