CVE-2026-71946 Overview
CVE-2026-71946 is a command injection vulnerability in D-Link DWR-M961 4G AC1200 LTE routers running hardware version C1 with firmware earlier than 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formPingDiagnosticRun web interface, where the host parameter passes unsanitized input to a shell context. A remote, unauthenticated attacker can inject arbitrary operating system commands and achieve execution as root. The weakness is classified under CWE-78: OS Command Injection.
Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected DWR-M961 routers, enabling full device takeover, traffic interception, and pivoting into internal networks.
Affected Products
- D-Link DWR-M961 4G AC1200 LTE Router (hardware version C1)
- Firmware versions prior to 1.1.5_C1_202607071108
- The /boafrm/formPingDiagnosticRun diagnostic web endpoint
Discovery Timeline
- 2026-08-08 - CVE-2026-71946 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-71946
Vulnerability Analysis
The DWR-M961 exposes a Boa-based web administration interface that includes diagnostic utilities such as ping. The formPingDiagnosticRun handler accepts a host field intended to hold an IP address or hostname. The handler concatenates this value directly into a shell command invoking the underlying ping binary without input validation or argument escaping.
Because the router firmware executes web service processes as root, any injected command inherits full administrative privileges. Attackers can plant persistent backdoors, modify firewall rules, alter DNS settings, or dump credentials. The endpoint is reachable over the network, and no authentication is required to trigger the vulnerable code path in exposed configurations.
Root Cause
The root cause is missing input sanitization on the host parameter of the /boafrm/formPingDiagnosticRun handler. Shell metacharacters such as ;, |, &, and backticks pass through to the command interpreter. This is a classic instance of [CWE-78] where user-controlled data is used to construct an OS command string.
Attack Vector
Exploitation requires only a single HTTP POST request to the router's management interface targeting /boafrm/formPingDiagnosticRun. An attacker supplies a crafted host value containing shell metacharacters followed by an arbitrary command. The Boa web server hands the concatenated string to the shell, which executes both the intended ping invocation and the injected payload. Refer to the VulnCheck advisory and the D-Link Security Advisory SAP10512 for further technical detail.
Detection Methods for CVE-2026-71946
Indicators of Compromise
- HTTP POST requests to /boafrm/formPingDiagnosticRun containing shell metacharacters (;, |, &, `, $() in the host field.
- Unexpected outbound connections from the router to attacker-controlled infrastructure, including reverse shells or download attempts via wget or curl.
- New or modified files in writable firmware directories, unexpected running processes, or unusual iptables rule changes on the device.
Detection Strategies
- Inspect web and reverse-proxy logs in front of the router for POST requests to the vulnerable endpoint containing non-standard characters in host.
- Monitor network flow telemetry for management-plane traffic reaching DWR-M961 devices from untrusted networks or the WAN interface.
- Compare running firmware banners and versions against the fixed build 1.1.5_C1_202607071108 during periodic asset inventory scans.
Monitoring Recommendations
- Forward router syslog and NetFlow data to a centralized analytics platform and alert on anomalous outbound connections initiated by embedded devices.
- Baseline normal administrative access patterns for the DWR-M961 and alert on management traffic originating from external IP ranges.
- Track DNS resolutions initiated by the router itself, which can reveal command-and-control callbacks planted through injected commands.
How to Mitigate CVE-2026-71946
Immediate Actions Required
- Upgrade DWR-M961 hardware version C1 devices to firmware 1.1.5_C1_202607071108 or later as published in D-Link Security Advisory SAP10512.
- Disable remote management on the WAN interface until the patch is applied.
- Rotate administrative credentials and audit device configuration after upgrade in case exploitation preceded remediation.
Patch Information
D-Link has released firmware 1.1.5_C1_202607071108 for the DWR-M961 (hardware C1) to address the command injection. Download the fixed firmware from the vendor advisory page and follow the documented upgrade procedure on the D-Link product page.
Workarounds
- Restrict access to the router's web administration interface to trusted internal management subnets using upstream ACLs.
- Block inbound requests to /boafrm/formPingDiagnosticRun at any intermediate firewall or reverse proxy until firmware can be applied.
- Segment DWR-M961 devices onto a dedicated management VLAN and deny direct Internet exposure of the administrative interface.
# Example upstream firewall rule to block external access to the vulnerable endpoint
iptables -I FORWARD -p tcp -d <router_ip> --dport 80 \
-m string --algo bm --string "/boafrm/formPingDiagnosticRun" -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
