CVE-2026-71955 in DWR-M961
Summary
by MITRE • 08/08/2026
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/08/2026
The D-Link DWR-M961 router series represents a significant security concern due to a critical command injection vulnerability present in specific hardware and software configurations. This vulnerability affects devices with hardware version C1 and software version 1.1.2_C1_202602110044, exposing them to remote exploitation through the web-based management interface. The flaw manifests within the /boafrm/formWsc endpoint which handles wireless setup configuration parameters, creating a pathway for malicious actors to execute arbitrary code with elevated privileges.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization within the web application layer of the router's firmware. Attackers can manipulate four specific parameters including localPin, targetAPSsid, peerPin, and peerRptPin fields to inject malicious commands that bypass normal security controls. These parameters are typically used for wireless setup procedures but are processed without proper escaping or filtering mechanisms, allowing attackers to append shell commands that execute within the router's context with root-level privileges. This represents a classic command injection vulnerability classified under CWE-77 and aligns with ATT&CK technique T1059.001 for command and script injection.
The operational impact of this vulnerability extends beyond simple remote code execution, as it provides attackers with complete administrative control over the affected devices. With root privileges, adversaries can modify network configurations, install persistent backdoors, access all device resources, and potentially use the compromised routers as launch points for further attacks within the local network. The vulnerability affects a specific product line that may be widely deployed in residential and small office environments, making it particularly concerning from a threat landscape perspective. Organizations relying on these devices face potential data breaches, network disruption, and unauthorized access to sensitive information.
Mitigation strategies should prioritize immediate firmware updates from D-Link to address the command injection flaw, though this requires proper patch management procedures to be effective. Network administrators should implement additional security controls such as firewall rules that restrict access to the web management interface, disable unnecessary services, and deploy network monitoring solutions to detect suspicious command execution patterns. The vulnerability demonstrates the importance of input validation at multiple layers and highlights the need for robust secure coding practices in embedded systems. Organizations should also consider implementing zero-trust network principles and regularly auditing their device configurations to minimize exposure to similar vulnerabilities that may exist in other network infrastructure components.