CVE-2026-71944 Overview
CVE-2026-71944 is a command injection vulnerability affecting D-Link DWR-M961 4G LTE routers with hardware version C1 running firmware versions prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formLtefotaUpgradeQuectel interface, where the fota_url parameter is passed to shell execution without sanitization. A remote unauthenticated attacker can inject arbitrary operating system commands and achieve execution with root privileges. The vulnerability is classified under [CWE-78] (OS Command Injection) and carries a CVSS 4.0 base score of 9.3.
Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected DWR-M961 routers, resulting in full device compromise.
Affected Products
- D-Link DWR-M961 4G AC1200 LTE Router (Hardware Version C1)
- Firmware versions prior to 1.1.5_C1_202607071108
- Devices exposing the FOTA upgrade web interface
Discovery Timeline
- 2026-08-08 - CVE-2026-71944 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-71944
Vulnerability Analysis
The DWR-M961 exposes a web management interface powered by the boa HTTP server. The endpoint /boafrm/formLtefotaUpgradeQuectel handles Firmware-Over-The-Air (FOTA) upgrades for the Quectel LTE modem module. This handler accepts a fota_url parameter intended to specify the URL of a firmware image to download.
Instead of validating the URL or passing it as an argument to a download utility using safe execution primitives, the firmware concatenates the attacker-supplied value into a shell command string. Shell metacharacters such as backticks, semicolons, and command substitution operators pass through to the underlying interpreter. The affected process runs as root, granting the injected commands unrestricted access to the device.
Successful exploitation enables attackers to modify router configuration, intercept LTE traffic, pivot into internal networks, or establish persistent backdoors on the device. Refer to the VulnCheck Advisory for additional technical context.
Root Cause
The root cause is missing input validation and unsafe command construction in the FOTA upgrade handler. The fota_url parameter is inserted directly into a shell command string without escaping, quoting, or allow-listing valid URL characters, violating the principle of separating code from data.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request to /boafrm/formLtefotaUpgradeQuectel with a malicious fota_url value containing shell metacharacters. The injected commands execute in the router's shell context with root privileges. See the D-Link Security Announcement SAP10512 for vendor guidance.
Detection Methods for CVE-2026-71944
Indicators of Compromise
- HTTP POST requests to /boafrm/formLtefotaUpgradeQuectel from untrusted sources or WAN interfaces
- fota_url parameter values containing shell metacharacters such as ;, |, &, `, or $()
- Outbound connections from the router to unfamiliar hosts, particularly following FOTA-related requests
- Unexpected new processes, cron entries, or listening services on the device
Detection Strategies
- Inspect HTTP request logs on upstream proxies or IDS sensors for requests targeting the vulnerable endpoint with anomalous parameter content
- Deploy signatures that flag shell metacharacter sequences within fota_url parameter values
- Correlate router administrative interface traffic sourced from WAN addresses, which should be blocked by default
Monitoring Recommendations
- Enable NetFlow or syslog forwarding from perimeter equipment to a centralized data lake for retrospective hunting
- Alert on router configuration changes and firmware version drift outside sanctioned maintenance windows
- Monitor for DNS queries and TCP connections originating from router management IPs to non-vendor infrastructure
How to Mitigate CVE-2026-71944
Immediate Actions Required
- Upgrade DWR-M961 C1 firmware to version 1.1.5_C1_202607071108 or later as published by D-Link
- Disable remote WAN-side administration on the router until the patch is applied
- Restrict LAN access to the management interface to a limited set of trusted administrative hosts
- Review router logs and configuration for signs of prior exploitation, including altered DNS settings and unknown accounts
Patch Information
D-Link has released a firmware update addressing this vulnerability. Consult the D-Link Security Announcement SAP10512 for the fixed firmware image and installation procedure. Product details for the affected model are available on the D-Link DWR-M961 product page.
Workarounds
- Block inbound HTTP and HTTPS traffic to the router's WAN interface at an upstream firewall
- Place the DWR-M961 behind a segmented management VLAN inaccessible to general user traffic
- Rotate administrative credentials after applying the patch to invalidate any previously exposed secrets
# Example upstream firewall rule to block WAN-side access to router HTTP management
iptables -I FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -I FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
