Description
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
Published: 2026-08-08
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A command‑injection flaw exists in the /boafrm/formPingDiagnosticRun interface of D-Link DWR‑M961 routers. By supplying a crafted value in the host field, a remote attacker can cause the device to execute arbitrary shell commands with root privileges, providing full control over the device.

Affected Systems

All D-Link DWR‑M961 routers with hardware version C1 running firmware versions earlier than 1.1.5_C1_202607071108 are affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.3, indicating critical severity. Because the attack vector is remote over the network and no mitigation is available in the firmware, exploitation is likely in environments where the router is reachable. Despite no EPSS data, the lack of CISA KEV listing does not reduce the urgency; the flaw permits execution with root privileges.

Generated by OpenCVE AI on August 8, 2026 at 18:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device firmware to version 1.1.5_C1_202607071108 or later.
  • Restrict or disable remote access to the /boafrm/ endpoint with firewall rules.
  • Enable only authorized management traffic, such as VPN or local network, to mitigate remote exploitation.

Generated by OpenCVE AI on August 8, 2026 at 18:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 08 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dwr-m961
Vendors & Products D-link
D-link dwr-m961

Sat, 08 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
References

Sat, 08 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
Title D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

D-link Dwr-m961
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-08T17:17:30.823Z

Reserved: 2026-08-08T16:43:04.176Z

Link: CVE-2026-71946

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-08T19:30:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')