CVE-2026-71945 Overview
CVE-2026-71945 is a command injection vulnerability in D-Link DWR-M961 4G LTE routers with hardware version C1 running firmware earlier than 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formLtefotaUpgradeFibocom interface, which processes firmware-over-the-air (FOTA) upgrade requests. A remote attacker can inject arbitrary shell commands into the fota_url parameter. Successful exploitation grants command execution with root privileges on the affected router. The issue is tracked under [CWE-78: OS Command Injection] and carries a CVSS 4.0 base score of 9.3.
Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected D-Link DWR-M961 routers, resulting in full device compromise.
Affected Products
- D-Link DWR-M961 4G AC1200 LTE Router (hardware version C1)
- Firmware versions prior to 1.1.5_C1_202607071108
- Fixed firmware: 1.1.5_C1_202607071108 and later
Discovery Timeline
- 2026-08-08 - CVE-2026-71945 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-71945
Vulnerability Analysis
The DWR-M961 web management interface exposes the /boafrm/formLtefotaUpgradeFibocom handler in the boa HTTP server. This handler processes FOTA upgrade requests for the internal Fibocom LTE module. The fota_url field submitted through this endpoint is passed to a system-level shell invocation without sanitization. Attackers can append shell metacharacters such as ;, |, or backticks to break out of the intended command context. The injected payload executes in the same process context as the web server, which runs as root on the device.
The vulnerability requires no authentication and no user interaction. An attacker with network reachability to the router's web interface can trigger the flaw with a single HTTP request.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The firmware concatenates the attacker-supplied fota_url value directly into a shell command string used to fetch and stage the FOTA image. No input validation, allowlisting, or safe process-execution API is applied before the command runs.
Attack Vector
Exploitation occurs over the network against the router's HTTP management service. The attacker submits a crafted POST request to /boafrm/formLtefotaUpgradeFibocom containing a malicious fota_url value with embedded shell metacharacters. When the firmware invokes the download routine, the appended commands execute as root. Full technical details are documented in the VulnCheck D-Link Command Injection Advisory.
No verified proof-of-concept code is publicly linked in the NVD entry. The vulnerability mechanism is described in prose to avoid publishing exploit content. Refer to the D-Link Security Advisory SAP10512 for vendor guidance.
Detection Methods for CVE-2026-71945
Indicators of Compromise
- HTTP POST requests to /boafrm/formLtefotaUpgradeFibocom containing shell metacharacters (;, |, &, backticks, $()) in the fota_url parameter.
- Outbound connections from the router to unfamiliar IP addresses shortly after receiving FOTA upgrade requests.
- Unexpected processes, cron entries, or persistence artifacts on the router filesystem originating from the boa web server.
Detection Strategies
- Inspect web application firewall or IDS logs for requests targeting the formLtefotaUpgradeFibocom endpoint from untrusted sources.
- Alert on any request to router management interfaces containing URL-encoded shell metacharacters in POST bodies.
- Correlate router configuration changes and outbound traffic anomalies with recent access to the LTE FOTA upgrade path.
Monitoring Recommendations
- Restrict and log all access to the router's HTTP management interface, particularly from WAN-side sources.
- Baseline expected FOTA activity so anomalous invocations of the upgrade endpoint stand out.
- Monitor DNS and NetFlow telemetry for the router's management IP to identify command-and-control callbacks.
How to Mitigate CVE-2026-71945
Immediate Actions Required
- Upgrade DWR-M961 hardware C1 devices to firmware 1.1.5_C1_202607071108 or later as published by D-Link.
- Disable WAN-side access to the router's web management interface until patched.
- Rotate administrative credentials on the device after applying the update in case prior compromise occurred.
Patch Information
D-Link has released fixed firmware version 1.1.5_C1_202607071108 addressing the command injection flaw. Download instructions and affected model coverage are provided in the D-Link Security Advisory SAP10512. Product details for the affected device are available on the D-Link Product Page.
Workarounds
- Block inbound TCP traffic to the router's HTTP/HTTPS management ports from untrusted networks using upstream firewall rules.
- Place the router management interface behind a VPN or restrict administrative access to a specific management VLAN.
- Disable remote management features if the deployment does not require them, limiting the exposed attack surface until firmware is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
