CVE-2026-71953 in DWR-M961
Summary
by MITRE • 08/08/2026
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/08/2026
The D-Link DWR-M961 router series represents a line of enterprise-grade wireless broadband routers designed for small to medium business environments. These devices operate with web-based management interfaces and incorporate standard network protocols including NTP for time synchronization. The specific hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 contain a critical command injection vulnerability that affects the /boafrm/formNtp interface. This interface handles configuration parameters related to Network Time Protocol servers, which are essential for maintaining accurate system time across networked devices.
The technical flaw manifests as improper input validation within the NTP server IP field processing mechanism. When an attacker submits malicious data into the ntpServerIp1 parameter through the web form interface, the application fails to sanitize or escape special characters that could be interpreted as shell commands. The vulnerability stems from direct command execution without proper sanitization of user-supplied input, allowing arbitrary code to be executed within the router's operating environment. This represents a classic command injection flaw categorized under CWE-77 and aligns with ATT&CK technique T1059.001 for Command and Scripting Interpreter.
The operational impact of this vulnerability is severe as it enables remote code execution with root privileges, effectively providing attackers with complete system control. An attacker can leverage this vulnerability to gain unauthorized access to the device's underlying operating system, modify network configurations, install malicious software, or use the device as a pivot point for attacks against other systems within the local network. The attack surface is particularly concerning given that the vulnerability exists in the web management interface, making it accessible over the internet without requiring physical access or prior authentication.
The security implications extend beyond immediate device compromise as these routers often serve as central network gateways. Once compromised, attackers can manipulate DNS settings, redirect traffic, or establish persistent backdoors for future access. The lack of input validation creates a pathway for attackers to execute system commands directly through the NTP configuration interface, potentially allowing them to modify firewall rules, disable security features, or extract sensitive network information. Organizations should immediately implement network segmentation measures and consider disabling unnecessary remote management interfaces while applying firmware updates to address this vulnerability. This vulnerability demonstrates the critical importance of input validation in web applications and highlights the need for proper security testing practices during firmware development cycles.