CVE-2026-71947 Overview
CVE-2026-71947 is a command injection vulnerability [CWE-78] affecting D-Link DWR-M961 4G LTE routers with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formTracerouteDiagnosticRun interface, where the host and ipVer parameters are passed to system shell commands without proper sanitization. A remote unauthenticated attacker can inject arbitrary operating system commands that execute with root privileges on the affected device. The vulnerability was disclosed through D-Link Security Advisory SAP10512 and an accompanying VulnCheck advisory.
Critical Impact
Remote unauthenticated attackers can execute arbitrary commands as root, resulting in full device compromise, network pivoting, and persistent implantation on affected DWR-M961 routers.
Affected Products
- D-Link DWR-M961 4G AC1200 LTE Router (hardware version C1)
- Firmware versions prior to 1.1.5_C1_202607071108
- Web management interface component /boafrm/formTracerouteDiagnosticRun
Discovery Timeline
- 2026-08-08 - CVE-2026-71947 published to NVD
- 2026-08-08 - Last updated in NVD database
Technical Details for CVE-2026-71947
Vulnerability Analysis
The vulnerability exists in the traceroute diagnostic handler exposed by the router's embedded boa web server. The endpoint /boafrm/formTracerouteDiagnosticRun accepts user-supplied values in the host and ipVer POST parameters, then concatenates those values into a shell command executed by the underlying operating system. Because the handler performs no input validation or output encoding, shell metacharacters injected into either parameter break out of the intended command context. The resulting commands execute in the router's root context, granting attackers control over network traffic, configuration storage, and firmware persistence.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The traceroute diagnostic function directly interpolates attacker-controlled parameters into a shell invocation without sanitization or use of safe execution APIs such as execve with argument arrays.
Attack Vector
Exploitation requires network access to the router's HTTP management interface. An attacker sends a crafted HTTP request to /boafrm/formTracerouteDiagnosticRun containing shell metacharacters such as ;, |, or backticks in the host or ipVer fields. No authentication or user interaction is required. Refer to the VulnCheck Advisory D-Link DWR-M961 for technical details of the injection pattern.
Detection Methods for CVE-2026-71947
Indicators of Compromise
- HTTP POST requests to /boafrm/formTracerouteDiagnosticRun containing shell metacharacters (;, |, &, `, $() in the host or ipVer parameters
- Unexpected outbound connections from the router to attacker-controlled infrastructure following diagnostic requests
- Unauthorized changes to router configuration, DNS settings, or firmware image
- New processes spawned by the boa web server that are not standard diagnostic utilities
Detection Strategies
- Inspect web server access logs on the router or upstream network taps for POST requests to /boafrm/formTracerouteDiagnosticRun with abnormal parameter contents
- Deploy network intrusion detection signatures that flag shell metacharacters in HTTP request bodies targeting the boa endpoint
- Monitor for anomalous DNS resolution or outbound TCP connections originating from the router's management IP
Monitoring Recommendations
- Restrict management interface access to trusted VLANs and alert on any WAN-side connection attempts to router administration ports
- Correlate router telemetry with endpoint and identity data in a central SIEM to detect lateral movement following router compromise
- Track firmware version and configuration hash on managed routers to identify unauthorized modifications
How to Mitigate CVE-2026-71947
Immediate Actions Required
- Update DWR-M961 hardware revision C1 devices to firmware 1.1.5_C1_202607071108 or later as directed by the D-Link Security Advisory SAP10512
- Disable remote (WAN-side) access to the router's HTTP management interface until patching is complete
- Rotate administrative credentials and pre-shared keys on any device suspected of exposure
Patch Information
D-Link has released firmware version 1.1.5_C1_202607071108 for the DWR-M961 hardware revision C1 to address this vulnerability. Firmware images and installation guidance are available through the D-Link Security Advisory SAP10512 and the D-Link Product Page for DWR-M961.
Workarounds
- Block inbound traffic to the router's HTTP/HTTPS management ports from untrusted networks using upstream firewall rules
- Place the router management interface on an isolated administrative VLAN accessible only from trusted hosts
- Disable the traceroute diagnostic feature in the router's web UI where the option is available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
