The flaw is a command injection vulnerability in the sub_419920 function of the /boafrm/formLtefotaUpgradeQuectel file. By manipulating the fota_url argument, a remote attacker can inject and execute arbitrary operating system commands on the device, which places the flaw in the CWE-74 and CWE-77 categories. This allows the attacker to gain full control of the affected router.

D-Link DWR-M961 routers running firmware version 1.1.47 are affected. Owners of devices with this firmware should verify whether they use this model and assess the need for remediation.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. However, the vulnerability is publicly documented, and exploits have been published, so the risk is not negligible. The attack requires network connectivity to the /boafrm/formLtefotaUpgradeQuectel endpoint, which may be reachable from the internet or internal networks depending on configuration. The device is not listed in CISA’s KEV catalog, but the exposure remains significant.