The flaw is in the SMS Message module of D‑Link DWR‑M961 firmware 1.1.47, specifically the sub_4250E0 function within /boafrm/formSmsManage. A crafted action_value argument can inject system commands. This allows a remote attacker to execute arbitrary commands with the privileges of the device, potentially exposing network traffic, rebooting the device, or compromising its operating system. The attack relies on insufficient input validation and the presence of a command‑execution trigger, which correlates with the CWE identifiers for command injection.

Vulnerable hardware is the D‑Link DWR‑M961 router running firmware version 1.1.47. No other product versions are listed as affected in the current data.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the device's web interface, specifically the SMS management endpoint. An attacker can send a crafted HTTP request with a malicious action_value payload, causing the router to execute arbitrary shell commands. The absence of an official exploit mitigations in the public domain means the attack surface is driven by user interaction with the router's SMS feature.