CVE-2026-1625: D-Link DWR-M961 RCE Vulnerability

CVE-2026-1625 Overview

A command injection vulnerability has been identified in the D-Link DWR-M961 wireless router running firmware version 1.1.47. The vulnerability exists in the function sub_4250E0 within the file /boafrm/formSmsManage, which is part of the SMS Message management component. By manipulating the action_value argument, an authenticated attacker can inject and execute arbitrary system commands on the affected device. The exploit has been publicly disclosed, increasing the risk of exploitation in the wild.

Critical Impact

Remote attackers with low privileges can execute arbitrary commands on vulnerable D-Link DWR-M961 routers, potentially leading to complete device compromise, network infiltration, and data exfiltration.

Affected Products

• D-Link DWR-M961 firmware version 1.1.47
• D-Link DWR-M961 devices with SMS Message management functionality enabled
• Network environments utilizing D-Link DWR-M961 as a gateway or access point

Discovery Timeline

• 2026-01-29 - CVE-2026-1625 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1625

Vulnerability Analysis

This command injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) affects the SMS Message management functionality of D-Link DWR-M961 routers. The vulnerability arises from insufficient input validation in the sub_4250E0 function, which processes user-supplied data through the action_value parameter without proper sanitization.

When a user interacts with the SMS management interface at /boafrm/formSmsManage, the submitted data is passed directly to system command execution functions. This allows an attacker to append or inject shell metacharacters and commands that will be executed with the privileges of the web server process—typically running as root on embedded devices like this router.

The network-accessible nature of this vulnerability combined with the low complexity required for exploitation makes it a significant risk for organizations and individuals using affected devices. Since the exploit has been made public, threat actors can readily weaponize this vulnerability to gain unauthorized access to target networks.

Root Cause

The root cause of CVE-2026-1625 is improper input validation in the sub_4250E0 function. The action_value parameter is incorporated into system commands without adequate sanitization or encoding of shell metacharacters. This allows specially crafted input containing command separators (such as ;, |, &&, or backticks) to break out of the intended command context and execute arbitrary commands. The lack of input validation in embedded device firmware is a common pattern due to resource constraints and legacy codebases.

Attack Vector

The attack can be initiated remotely over the network by an authenticated user with low privileges. The attacker must have access to the router's web management interface, either through legitimate credentials or by exploiting weak default passwords commonly found on IoT devices. Once authenticated, the attacker sends a specially crafted HTTP request to /boafrm/formSmsManage with a malicious payload in the action_value parameter.

The vulnerability can be exploited by injecting shell commands into the action_value parameter of the SMS management endpoint. The malicious input is processed by the sub_4250E0 function and passed to system command execution without proper sanitization, allowing arbitrary command execution on the underlying operating system. For detailed technical information about this vulnerability, refer to the GitHub Issue Discussion and VulDB entry #343384.

Detection Methods for CVE-2026-1625

Indicators of Compromise

• Unusual HTTP POST requests to /boafrm/formSmsManage containing shell metacharacters (;, |, &&, `) in the action_value parameter
• Unexpected outbound connections from D-Link DWR-M961 devices to external IP addresses
• Modified system files or unauthorized configuration changes on affected routers
• Anomalous process execution or unexpected child processes spawned by the web server

Detection Strategies

• Implement network traffic monitoring to detect HTTP requests to /boafrm/formSmsManage with suspicious patterns in POST data
• Deploy intrusion detection system (IDS) rules to identify command injection patterns targeting D-Link devices
• Monitor router logs for authentication attempts followed by access to the SMS management functionality
• Configure SentinelOne Singularity to monitor network endpoints for connections to vulnerable D-Link devices exhibiting anomalous behavior

Monitoring Recommendations

• Enable detailed logging on D-Link DWR-M961 devices and forward logs to a centralized SIEM solution
• Establish baseline network behavior for IoT devices and alert on deviations
• Regularly audit web server access logs for unusual request patterns targeting administrative endpoints
• Implement network segmentation to isolate vulnerable IoT devices from critical infrastructure

How to Mitigate CVE-2026-1625

Immediate Actions Required

• Restrict network access to the D-Link DWR-M961 management interface to trusted IP addresses only
• Disable the SMS Message management functionality if not required for business operations
• Change default credentials and implement strong, unique passwords for router administration
• Implement network segmentation to isolate affected devices from sensitive network resources
• Monitor for firmware updates from D-Link and apply patches as soon as they become available

Patch Information

As of the last modification date (2026-01-29), no official patch has been confirmed by D-Link for this vulnerability. Organizations should monitor the D-Link Official Website for security advisories and firmware updates addressing CVE-2026-1625. In the interim, implementing the recommended workarounds is critical to reduce exposure risk.

Workarounds

• Implement firewall rules to block external access to the /boafrm/formSmsManage endpoint
• Use a web application firewall (WAF) or reverse proxy with input validation rules to filter malicious requests
• Disable remote management access and require physical or VPN-based access for administrative tasks
• Consider replacing affected devices with alternative products that receive regular security updates

# Example iptables rule to restrict management interface access
# Adjust IP ranges and interface names for your environment
iptables -A INPUT -i eth0 -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j DROP