CVE-2026-71948: D-Link DWR-M961 RCE Vulnerability

CVE-2026-71948 Overview

CVE-2026-71948 is a command injection vulnerability in D-Link DWR-M961 4G AC1200 LTE routers running hardware version C1 with firmware prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formDebugDiagnosticRun interface, where the host parameter is passed to a shell without proper sanitization. A remote, unauthenticated attacker can inject arbitrary operating system commands that execute with root privileges. The vulnerability is tracked under CWE-78 (OS Command Injection) and carries a CVSS 4.0 base score of 9.3.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected DWR-M961 routers, enabling full device takeover, traffic interception, and pivoting into connected networks.

Affected Products

D-Link DWR-M961 4G AC1200 LTE Router (Hardware Revision C1)
Firmware versions prior to 1.1.5_C1_202607071108
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2026-08-08 - CVE-2026-71948 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71948

Vulnerability Analysis

The DWR-M961 web management interface is served by the boa embedded HTTP server, which exposes the /boafrm/formDebugDiagnosticRun endpoint for network diagnostic operations such as ping and traceroute. The handler accepts a host field from the HTTP request and forwards it into a shell command constructed at runtime. Because the router does not validate or escape shell metacharacters in the host value, an attacker can append commands using separators such as ;, |, &&, or backticks.

Commands invoked through this interface run as root, matching the privilege level of the boa process on the device. Successful exploitation grants complete control over the router, including the ability to modify firmware, alter DNS settings, capture LAN and WAN traffic, and establish persistence. See the VulnCheck advisory for additional technical context.

Root Cause

The root cause is missing input validation on the host parameter processed by the diagnostic handler. User-controlled input is concatenated directly into a shell invocation without allowlisting valid hostnames or IP addresses, and without escaping metacharacters. This is a classic instance of CWE-78.

Attack Vector

Exploitation occurs over the network against the router's HTTP management interface. The attacker sends a crafted POST request to /boafrm/formDebugDiagnosticRun containing a host field with an injected shell payload. No authentication or user interaction is required for exploitation when the management interface is reachable. Devices with WAN-side management exposed are directly attackable from the internet, while LAN-only deployments remain reachable from any client on the internal network, including compromised endpoints and rogue devices.

A proof-of-concept exploit is not publicly listed in the enriched data. Refer to the D-Link Security Publication SAP10512 for vendor guidance.

Detection Methods for CVE-2026-71948

Indicators of Compromise

HTTP POST requests to /boafrm/formDebugDiagnosticRun containing shell metacharacters (;, |, &, `, $() in the host field
Outbound connections from the router to unfamiliar IP addresses, particularly on ports commonly used for reverse shells or tunneling
Unexpected modifications to router configuration, DNS servers, or firmware image
New processes spawned by boa that are not part of normal diagnostic operations

Detection Strategies

Inspect web server and reverse proxy logs upstream of the router for requests targeting /boafrm/formDebugDiagnosticRun with anomalous host values
Deploy network intrusion detection signatures that flag command-injection metacharacters in HTTP request bodies to the router
Correlate router NetFlow or syslog data with endpoint telemetry to detect lateral movement originating from the device

Monitoring Recommendations

Enable and forward router syslog to a central log platform for retention and analysis
Alert on any authentication events or configuration changes to the DWR-M961 management interface
Monitor DNS query patterns from clients behind the router for signs of hijacked resolvers

How to Mitigate CVE-2026-71948

Immediate Actions Required

Upgrade DWR-M961 firmware to version 1.1.5_C1_202607071108 or later as provided in the D-Link Security Publication SAP10512
Disable remote (WAN-side) management on the router until patching is complete
Restrict LAN access to the management interface to a dedicated administrative subnet or VLAN
Rotate administrative credentials after patching in case the device was previously compromised

Patch Information

D-Link has released firmware version 1.1.5_C1_202607071108 for the DWR-M961 hardware revision C1, which addresses the command injection flaw in /boafrm/formDebugDiagnosticRun. Firmware and release notes are available from the D-Link DWR-M961 product page and the vendor security publication.

Workarounds

Block inbound access to the router's HTTP management port from the WAN interface at the upstream firewall
Place the router behind a segmented management network accessible only via VPN
Filter HTTP requests to /boafrm/formDebugDiagnosticRun at any inline security appliance until firmware is updated

bash

# Example: block WAN access to router HTTP management (upstream firewall)
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP