Executive Summary

A critical command injection vulnerability (CVE-2026-71945) has been discovered in D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108. This vulnerability allows a remote attacker to inject arbitrary malicious commands, resulting in command execution with root privileges. The vulnerability has a CVSS score of 9.8, indicating a high severity level.

Technical Analysis

The vulnerability is a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface of the D-Link DWR-M961 device. The vulnerability occurs because the device does not properly validate user input, allowing an attacker to inject malicious commands into the fota_url field. This can result in command execution with root privileges.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted request to the /boafrm/formLtefotaUpgradeFibocom interface with a malicious fota_url field. The device fails to properly validate the input, allowing the attacker to inject arbitrary malicious commands. The attacker can then execute these commands with root privileges, potentially gaining full control of the device.

Impact Assessment

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 are affected by this vulnerability. An attacker can achieve arbitrary code execution with root privileges, potentially leading to a complete compromise of the device. The CVSS score for this vulnerability is 9.8, indicating a high severity level.

Recommended Actions

To mitigate this vulnerability, affected organizations should update their D-Link DWR-M961 devices to firmware version 1.1.5_C1_202607071108 or later. Additionally, organizations should:

  • Block access to the /boafrm/formLtefotaUpgradeFibocom interface from untrusted networks
  • Implement a web application firewall (WAF) rule to detect and prevent malicious requests to this interface
  • Monitor device logs for suspicious activity

Sources

  • National Vulnerability Database (NVD)
  • D-Link Corporation
  • Vulncheck