CVE-2026-71947 in DWR-M961
Summary
by MITRE • 08/08/2026
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/08/2026
The D-Link DWR-M961 router series represents a class of enterprise-grade wireless broadband routers that have been identified with a critical command injection vulnerability affecting specific hardware and firmware configurations. This vulnerability resides within the web-based administration interface at the /boafrm/formTracerouteDiagnosticRun endpoint, where the device fails to properly sanitize user-supplied input parameters. The affected hardware version C1 combined with firmware versions prior to 1.1.5_C1_202607071108 creates a dangerous attack surface that allows remote exploitation without authentication requirements. The vulnerability specifically targets the host and ipVer fields within the traceroute diagnostic functionality, which are directly incorporated into system commands without adequate input validation or sanitization mechanisms.
The technical implementation of this command injection flaw stems from improper handling of user-controllable parameters within the router's web server framework. When an attacker submits malicious input through the host field or ipVer parameter, the application concatenates these values directly into shell execution commands without proper escaping or filtering of special characters. This design flaw allows attackers to inject operating system commands that are subsequently executed with the highest privileges available to the web server process. The vulnerability manifests as a direct path to arbitrary code execution on the underlying operating system, which typically runs with root privileges due to the nature of network device management interfaces.
The operational impact of this vulnerability extends beyond simple remote code execution to encompass complete system compromise and potential lateral movement within network environments. An attacker who successfully exploits this vulnerability can gain full administrative control over the affected router, potentially enabling them to modify network configurations, redirect traffic, establish persistent backdoors, or use the device as a pivot point for attacking other systems on the network. The root privilege escalation aspect means that even if network segmentation is implemented, attackers can bypass many traditional security controls and access sensitive system resources including configuration files, user credentials stored in memory, and network traffic monitoring capabilities. This vulnerability directly aligns with CWE-77 and CWE-94 categories related to command injection and code injection flaws, which are among the most dangerous classes of vulnerabilities in web applications.
Mitigation strategies for this vulnerability should prioritize immediate firmware updates from D-Link to version 1.1.5_C1_202607071108 or later, which contain proper input validation and sanitization measures. Network administrators should also implement network segmentation and access control lists to limit exposure of these devices to untrusted networks, while monitoring for suspicious traffic patterns that may indicate exploitation attempts. The implementation of web application firewalls and intrusion detection systems can help detect and block malicious payloads targeting this specific vulnerability. Additionally, organizations should conduct thorough network scans to identify all affected devices and ensure proper network access controls are in place to prevent unauthorized remote access to administrative interfaces. From an ATT&CK framework perspective, this vulnerability maps directly to techniques involving command execution and privilege escalation, making it particularly concerning for organizations that rely on these devices for network infrastructure management and security controls.