CVE-2026-1596: D-Link DWR-M961 Firmware RCE Vulnerability

CVE-2026-1596 Overview

CVE-2026-1596 is a command injection vulnerability in the D-Link DWR-M961 LTE router running firmware version 1.1.47. The flaw resides in the sub_419920 function within /boafrm/formLtefotaUpgradeQuectel. Attackers can manipulate the fota_url parameter to inject arbitrary shell commands. The issue is classified under [CWE-74] for improper neutralization of special elements in output.

The vulnerability is remotely exploitable and requires only low-privilege authentication. A public exploit has been disclosed through VulDB and a public GitHub issue tracker, increasing the likelihood of opportunistic abuse against exposed devices.

Critical Impact

Authenticated attackers can inject operating system commands through the LTE FOTA upgrade endpoint, enabling unauthorized command execution on affected D-Link DWR-M961 routers.

Affected Products

• D-Link DWR-M961 LTE router (hardware)
• D-Link DWR-M961 firmware version 1.1.47
• Deployments exposing the /boafrm/formLtefotaUpgradeQuectel web interface

Discovery Timeline

• 2026-01-29 - CVE-2026-1596 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-1596

Vulnerability Analysis

The DWR-M961 web management interface exposes a FOTA (Firmware Over-The-Air) upgrade handler at /boafrm/formLtefotaUpgradeQuectel. The handler is implemented in the binary function sub_419920. This function processes the fota_url HTTP parameter intended to specify a remote firmware image URL.

The handler concatenates the user-supplied fota_url value into a shell command string without sanitization. Shell metacharacters such as ;, |, &, and backticks pass through to the underlying command interpreter. An attacker submits a crafted HTTP request containing shell control characters in fota_url to execute arbitrary commands.

The vulnerability falls under [CWE-74], improper neutralization of special elements in output used by a downstream component. The exploitation is network-reachable when the router management interface is accessible, and requires a valid low-privilege session.

Root Cause

The root cause is missing input validation on the fota_url parameter before it is passed to a system shell. The firmware lacks both allowlist validation of URL syntax and proper escaping of shell metacharacters when constructing the FOTA download command.

Attack Vector

An authenticated attacker on the network sends an HTTP POST request to /boafrm/formLtefotaUpgradeQuectel with a fota_url value containing injected shell commands. The web server (boa) invokes the FOTA upgrade routine, which passes the tainted value into a shell command. Injected commands execute under the privileges of the web service, typically root on embedded routers. Public exploit material is available via the referenced GitHub issue and the VulDB advisory.

No verified exploit code is reproduced here. Technical details are available in the linked references.

Detection Methods for CVE-2026-1596

Indicators of Compromise

• HTTP requests to /boafrm/formLtefotaUpgradeQuectel containing shell metacharacters (;, |, &, `, $() in the fota_url parameter.
• Unexpected outbound connections from the router to attacker-controlled hosts following FOTA endpoint access.
• New or modified processes spawned by the boa web server on the device.
• Configuration or credential file changes immediately following requests to the FOTA upgrade URI.

Detection Strategies

• Inspect HTTP traffic to D-Link DWR-M961 management interfaces for non-URL characters within fota_url.
• Correlate authenticated session activity with subsequent anomalous DNS lookups or outbound TCP connections originating from the router.
• Alert on access to /boafrm/formLtefotaUpgradeQuectel from any source outside an explicit administrative allowlist.

Monitoring Recommendations

• Capture and retain router web server access logs centrally for review of FOTA endpoint requests.
• Monitor router WAN-side exposure of TCP/80 and TCP/443 management services using external attack surface scans.
• Track firmware versions across the DWR-M961 fleet to identify devices still running 1.1.47.

How to Mitigate CVE-2026-1596

Immediate Actions Required

• Restrict access to the router management interface to trusted administrative networks only and disable WAN-side management.
• Rotate all administrative credentials on affected DWR-M961 devices to limit reuse of low-privilege accounts that enable exploitation.
• Audit current firmware versions and inventory all DWR-M961 units running 1.1.47.
• Monitor the D-Link support site for an official firmware update addressing the FOTA handler.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-1596. Operators should track the D-Link Official Website and the VulDB advisory for an updated firmware release that sanitizes the fota_url parameter in sub_419920.

Workarounds

• Block external access to TCP/80 and TCP/443 on the router WAN interface using upstream firewall rules.
• Place affected routers behind a VPN concentrator and require VPN authentication before reaching the management plane.
• Disable remote FOTA update functionality through router configuration where supported, and perform manual firmware updates instead.

# Example upstream firewall rule to block WAN-side router admin access
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP