CVE-2026-71952 in DWR-M961
Summary
by MITRE • 08/08/2026
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/08/2026
The D-Link DWR-M961 router series represents a line of wireless broadband routers that incorporate web-based management interfaces for configuration and administration purposes. These devices are commonly deployed in small office and home environments where network connectivity and security are paramount. The specific hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 contain a critical command injection vulnerability that affects the /boafrm/formPinManageSetup interface. This vulnerability stems from insufficient input validation and sanitization within the web application layer, creating an exploitable condition where malicious commands can be executed with elevated privileges.
The technical flaw manifests in the improper handling of user-supplied data within the oldPIn field parameter of the PIN management form. When a remote attacker submits specially crafted input to this field, the application fails to properly sanitize or escape the input before processing it within system commands. This vulnerability directly maps to CWE-77 Command Injection, which occurs when an application passes untrusted data to an interpreter as part of a command that is executed with elevated privileges. The attack vector is particularly dangerous because the web interface operates with root privileges, meaning any successfully injected command executes with full administrative access to the device. This allows attackers to gain complete control over the router's functionality, potentially enabling them to modify network configurations, intercept traffic, or establish persistent access points.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass a comprehensive range of security compromises. Attackers can leverage this command injection flaw to execute arbitrary code on the affected devices, potentially leading to complete system compromise and unauthorized network infiltration. The vulnerability affects all users of the vulnerable firmware versions regardless of their physical location or network isolation status since it is accessible through the web interface without requiring authentication. This remote exploit capability means that attackers can target these devices from anywhere on the internet, making them particularly attractive targets for large-scale automated attacks. The compromised device becomes a potential pivot point for attackers to move laterally within networks, potentially accessing connected systems or services that may not be directly exposed to the internet.
Mitigation strategies should focus on immediate firmware updates provided by D-Link to address this vulnerability. Organizations and individuals should prioritize upgrading to firmware version 1.1.5_C1_202607071108 or later, which includes proper input validation and sanitization measures. Network segmentation and access control measures can provide additional defense-in-depth layers, including restricting access to the web management interface to trusted IP addresses only. Implementing network monitoring solutions that can detect unusual command execution patterns or unauthorized access attempts may help identify exploitation attempts. Security professionals should also consider disabling unnecessary services and features on affected devices while conducting regular vulnerability assessments to identify other potential entry points. The ATT&CK framework categorizes this type of vulnerability under T1059 Command and Scripting Interpreter, specifically targeting the use of command-line interfaces for malicious purposes, making proper input validation a critical defensive measure against such exploitation techniques.