CVE-2026-71949 in DWR-M961
Summary
by MITRE • 08/08/2026
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/08/2026
This vulnerability exists within D-Link DWR-M961 cellular routers running hardware version C1 with firmware versions prior to 1.1.5_C1_202607071108 and represents a critical command injection flaw in the web management interface. The specific vulnerable endpoint /boafrm/formUSSDSetup accepts user input through two parameters ussdValue and selectMenuValue without proper sanitization or validation, creating an opportunity for remote code execution. This issue falls under CWE-77 which describes improper neutralization of special elements used in command execution contexts, making it a classic command injection vulnerability that allows attackers to execute arbitrary system commands with elevated privileges.
The technical exploitation occurs through the web interface where unfiltered input is directly passed to system commands without proper escaping or filtering mechanisms. When an attacker submits malicious content into either ussdValue or selectMenuValue fields, the application processes these inputs without adequate sanitization, allowing command injection attacks to succeed. The vulnerability results in execution with root privileges because the web application runs with administrative permissions, enabling attackers to gain complete system control including access to network configurations, user data, and potentially other connected devices within the network.
From an operational perspective this vulnerability poses significant risk as it allows remote attackers to execute commands without authentication, making it particularly dangerous for devices deployed in untrusted network environments. The attack surface extends beyond simple command execution to include potential lateral movement within networks where these routers might be located. According to ATT&CK framework, this maps to T1059.001 Command and Scripting Interpreter with specific emphasis on T1068 Local Privilege Escalation, as the vulnerability allows for privilege escalation from regular web interface access to root system privileges.
The impact of this vulnerability extends beyond immediate exploitation as it provides attackers with persistent access to network infrastructure and can be used to establish backdoors or exfiltrate sensitive information. The lack of proper input validation in the USSD setup functionality makes it particularly concerning since USSD commands are typically used for legitimate network operations but become dangerous when misused through injection attacks. Organizations using these devices should immediately implement firmware updates from D-Link as recommended, and consider network segmentation to limit access to these management interfaces. Additionally, implementing web application firewalls and monitoring for suspicious command execution patterns can help detect exploitation attempts.
The vulnerability demonstrates the importance of proper input validation in web applications and highlights how seemingly benign features like USSD command support can become attack vectors when not properly secured. This type of flaw is particularly dangerous in IoT and network infrastructure devices where remote access capabilities are common but security controls may be insufficient. The remediation approach should include not only firmware updates but also security awareness training for administrators on the importance of keeping network equipment patched and monitoring for unusual network behavior that might indicate exploitation attempts.