CVE-2026-71950 in DWR-M961
Summary
by MITRE • 08/08/2026
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/08/2026
The D-Link DWR-M961 router series represents a significant security concern due to a critical command injection vulnerability present in specific hardware and firmware configurations. This vulnerability affects devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108, creating a substantial attack surface for malicious actors targeting network infrastructure. The vulnerability resides within the /boafrm/formSmsManage interface, which serves as an administrative endpoint for SMS management functionalities. This particular interface fails to properly validate or sanitize user input, creating an exploitable condition that allows remote attackers to inject malicious commands directly into the system.
The technical flaw manifests through improper input validation in the action_value field parameter, which is processed without adequate sanitization measures. When an attacker submits a crafted payload containing malicious commands through this field, the system executes these commands with root privileges due to insufficient access controls and input filtering mechanisms. This command injection vulnerability directly maps to CWE-77, which describes improper neutralization of special elements used in commands, and represents a severe escalation from standard privilege levels to full system compromise. The attack vector is entirely remote, requiring no physical access or authentication credentials, making it particularly dangerous for network administrators who may not be aware of the exploitation.
The operational impact of this vulnerability extends far beyond simple unauthorized command execution, as it grants attackers complete control over affected devices and their underlying network infrastructure. A successful exploitation allows malicious actors to establish persistent backdoors, modify network configurations, intercept communications, or launch further attacks against connected systems. The root privilege escalation means that attackers can manipulate system files, install malware, modify firewall rules, or disable security features entirely. This vulnerability poses significant risk to both enterprise and home network environments, as D-Link routers often serve as primary gateways for internet connectivity and may be deployed in unattended locations where physical security is minimal. The implications align with ATT&CK technique T1059.001 for command and scripting interpreter, specifically focusing on the execution of system commands through legitimate interfaces.
Mitigation strategies should prioritize immediate firmware updates to version 1.1.5_C1_202607071108 or later, which contain patches addressing the input validation deficiencies in the affected interface. Network administrators should implement strict network segmentation and firewall rules to limit access to administrative interfaces, particularly when these devices are exposed to public networks. Additional protective measures include disabling unnecessary services, implementing strong authentication mechanisms, and conducting regular security audits of network infrastructure components. The vulnerability demonstrates the critical importance of proper input validation and privilege separation in embedded systems, as highlighted by industry standards such as NIST SP 800-128 which emphasizes secure coding practices for network devices. Organizations should also consider deploying intrusion detection systems to monitor for suspicious activity patterns that may indicate exploitation attempts against similar vulnerabilities in other network infrastructure components.