D-Link DWR-M961 routers with hardware version C1 and firmware older than 1.1.5_C1_202607071108 allow a command injection flaw in the /boafrm/formTracerouteDiagnosticRun endpoint. The flaw lets an attacker submit malicious payloads in the host and ipVer parameters, causing the device to execute arbitrary shell commands as root. This can lead to full system compromise, data theft, or disruption of network services.

The vulnerability affects D-Link Corporation’s DWR‐M961 4G‑AC1200 LTE router, specifically hardware revision C1 and firmware releases prior to 1.1.5_C1_202607071108. Any installation of this model with the affected firmware is at risk.

The CVSS score of 9.3 indicates critical severity. The EPSS score is not available, so the precise likelihood of exploitation cannot be quantified, but the absence of a KEV listing does not diminish the risk for a device exposed to the internet. As the flaw uses a standard HTTP endpoint, remote exploitation is possible from outside the local network, especially if the router is exposed or has default credentials. The attack requires only network access and can be performed through a crafted HTTP request.