Description
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
Published: 2026-08-08
Score: 9.3 Critical
EPSS: 2.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A command‑injection flaw exists in the /boafrm/formPingDiagnosticRun interface of D-Link DWR‑M961 routers. By supplying a crafted value in the host field, a remote attacker can cause the device to execute arbitrary shell commands with root privileges, providing full control over the device.

Affected Systems

All D-Link DWR‑M961 routers with hardware version C1 running firmware versions earlier than 1.1.5_C1_202607071108 are affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score of 2%, while low, shows that some exploitation attempts are likely in networks where the router is reachable. Because the attack vector is remote over the network and no firmware mitigation is available, exploitation is likely in environments where the router is exposed. The lack of a CISA KEV listing does not reduce urgency, and the flaw permits execution with root privileges.

Generated by OpenCVE AI on August 9, 2026 at 14:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device firmware to version 1.1.5_C1_202607071108 or later.
  • Restrict or disable remote access to the /boafrm/ endpoint with firewall rules.
  • Enable only authorized management traffic, such as VPN or local network, to mitigate remote exploitation.

Generated by OpenCVE AI on August 9, 2026 at 14:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dwr-m961
CPEs cpe:2.3:h:dlink:dwr-m961:*:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dwr-m961

Thu, 13 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 08 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dwr-m961
Vendors & Products D-link
D-link dwr-m961

Sat, 08 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
References

Sat, 08 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
Title D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

D-link Dwr-m961
Dlink Dwr-m961
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-14T16:51:41.688Z

Reserved: 2026-08-08T16:43:04.176Z

Link: CVE-2026-71946

cve-icon Vulnrichment

Updated: 2026-08-11T17:48:08.833Z

cve-icon NVD

Status : Received

Published: 2026-08-08T17:16:47.847

Modified: 2026-08-11T18:18:22.470

Link: CVE-2026-71946

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-09T14:30:01Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')