D-Link DWR-M961 routers with hardware version C1 and firmware older than 1.1.5_C1_202607071108 allow a command injection flaw in the /boafrm/formTracerouteDiagnosticRun endpoint. The flaw lets an attacker submit malicious payloads in the host and ipVer parameters, causing the device to execute arbitrary shell commands as root. Based on the impact of root‑privilege command execution, it is inferred that the device could be fully compromised, allowing data theft or disruption of network services.

The vulnerability affects D-Link Corporation’s DWR‑M961 4G‑AC1200 LTE router, specifically hardware revision C1 and firmware releases prior to 1.1.5_C1_202607071108. Any installation of this model with the affected firmware is at risk.

The CVSS score of 9.3 indicates critical severity. The EPSS score is 2%, indicating a low probability of exploitation. Based on the fact that the vulnerability is bound to a standard HTTP endpoint, it is inferred that remote exploitation is possible from outside the local network, especially when the router is exposed or default credentials are in use. The attack requires only network access and can be performed through a crafted HTTP request. Although the vulnerability is not listed in KEV, it is inferred that the risk remains significant for devices exposed to the internet.