CVE-2026-71954 in DWR-M961
Summary
by MITRE • 08/08/2026
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/08/2026
The D-Link DWR-M961 router series represents a class of enterprise-grade networking equipment that serves as critical infrastructure components for small to medium businesses. These devices operate as Layer 2 Tunneling Protocol version 3 (L2TPv3) gateways, facilitating secure network connections between remote locations and corporate networks. The vulnerability resides within the web-based administration interface at the /boafrm/formL2tpv3ConfigSetup endpoint, which processes user input through tunnelid and sessionid parameters without proper sanitization or validation mechanisms. This represents a significant security flaw that undermines the device's integrity and exposes organizations to potential compromise of their network infrastructure.
The technical flaw manifests as a command injection vulnerability classified under CWE-77, which occurs when application input is directly incorporated into system commands without appropriate escaping or filtering. The affected parameters tunnelid and sessionid are processed within the context of shell commands executed by the device's operating system, allowing an attacker to append malicious commands that will execute with the highest privilege level available to the web server process. This privilege escalation to root access enables attackers to gain complete control over the device, potentially leading to data exfiltration, network disruption, or use as a pivot point for further attacks within the organization's network.
The operational impact of this vulnerability extends beyond simple unauthorized access, creating substantial risk for organizations relying on these devices for network connectivity. Remote exploitation allows attackers to execute arbitrary code with root privileges from any location with network access to the device, making it particularly dangerous for unsecured or poorly monitored network environments. The vulnerability affects hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108, indicating that a significant portion of deployed devices may remain vulnerable. This exposure could result in complete network compromise, data breaches, service interruption, or use as an entry point for broader attacks against enterprise infrastructure.
Mitigation strategies should focus on immediate firmware updates to version 1.1.5_C1_202607071108 or later, which address the command injection vulnerability through proper input validation and sanitization mechanisms. Organizations should also implement network segmentation to limit access to administrative interfaces, restrict remote management capabilities, and deploy network monitoring solutions to detect anomalous command execution patterns. Additionally, implementing principle of least privilege for web interface access, disabling unnecessary services, and conducting regular security assessments can help reduce the attack surface and prevent exploitation of similar vulnerabilities in other components of the network infrastructure. This vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: Unix Shell, highlighting the need for comprehensive defensive measures against shell-based command injection attacks across enterprise environments.