CVE-2026-71949: D-Link DWR-M961 RCE Vulnerability

CVE-2026-71949 Overview

CVE-2026-71949 is a command injection vulnerability affecting D-Link DWR-M961 4G LTE routers with hardware version C1 running firmware versions prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formUSSDSetup interface, which fails to sanitize user-supplied input in the ussdValue and selectMenuValue parameters. A remote attacker can inject arbitrary shell commands that execute with root privileges on the device. The vulnerability is classified under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command). The EPSS score is 2.086%, placing this issue in the 79.9th percentile of exploit-likelihood predictions.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected DWR-M961 routers, enabling full device takeover, traffic interception, and pivoting into internal networks.

Affected Products

D-Link DWR-M961 4G AC1200 LTE Router (hardware version C1)
Firmware versions prior to 1.1.5_C1_202607071108
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2026-08-08 - CVE-2026-71949 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-71949

Vulnerability Analysis

The DWR-M961 web management interface is served by the boa HTTP daemon commonly found in embedded Linux router firmware. The /boafrm/formUSSDSetup handler processes Unstructured Supplementary Service Data (USSD) configuration submitted by administrators to control cellular modem behavior. The handler accepts two attacker-controllable fields, ussdValue and selectMenuValue, and passes their contents into an operating system command string without neutralizing shell metacharacters.

Because the boa server on this device runs as root, any injected command inherits root privileges. Successful exploitation grants full control over the router, including the ability to modify firmware, alter DNS resolution, sniff traffic traversing the WAN and LAN interfaces, and establish persistent implants. The absence of authentication requirements in the CVSS 4.0 vector indicates the endpoint is reachable without valid credentials on affected configurations.

Root Cause

The root cause is improper input neutralization ([CWE-78]) in the USSD setup handler. User input is concatenated into a shell command invocation, allowing shell metacharacters such as ;, |, &&, and backticks to break out of the intended argument context and execute attacker-chosen binaries.

Attack Vector

An attacker sends a crafted HTTP POST request to /boafrm/formUSSDSetup over the network, embedding shell metacharacters in the ussdValue or selectMenuValue form parameters. The injected payload is executed by the underlying shell as root. Refer to the VulnCheck Advisory: D-Link DWR-M961 Command Injection for additional technical details.

// No verified public exploit code is available at this time.
// Consult the vendor and VulnCheck advisories for technical specifics.

Detection Methods for CVE-2026-71949

Indicators of Compromise

HTTP POST requests to /boafrm/formUSSDSetup containing shell metacharacters such as ;, |, &, or backticks in the ussdValue or selectMenuValue parameters
Unexpected outbound connections originating from the router to attacker-controlled infrastructure
Unauthorized changes to DNS server configuration, firewall rules, or administrative credentials on the device
New or modified files under writable filesystem paths on the router following USSD-related HTTP activity

Detection Strategies

Inspect web server and reverse proxy logs for POST requests to /boafrm/formUSSDSetup with suspicious characters in USSD parameters
Deploy network intrusion detection signatures that flag shell metacharacters within HTTP bodies targeting the boa management interface
Correlate router configuration changes with source IP addresses that do not match administrator baselines

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized SIEM for retention and analysis
Alert on any inbound access to the router administrative interface from WAN-side sources
Monitor DNS query patterns from clients behind the router for redirection to unusual resolvers

How to Mitigate CVE-2026-71949

Immediate Actions Required

Upgrade DWR-M961 hardware C1 units to firmware 1.1.5_C1_202607071108 or later as published by D-Link
Restrict access to the router management interface so it is not reachable from the WAN or untrusted VLANs
Change administrative credentials after patching and review the device configuration for unauthorized modifications

Patch Information

D-Link has released fixed firmware in the D-Link Security Announcement SAP10512. Administrators should apply firmware version 1.1.5_C1_202607071108 or newer to eliminate the command injection in /boafrm/formUSSDSetup. Verify the installed firmware version through the router administration UI after upgrade.

Workarounds

Disable remote administration on the WAN interface until firmware can be applied
Place the router management interface behind a management VLAN or ACL that limits access to trusted administrator hosts
Block inbound traffic to the boa HTTP service at an upstream firewall for devices that cannot be patched immediately

bash

# Example: restrict access to the router management interface with an upstream ACL
# Replace 192.0.2.10 with the trusted administrator host and 198.51.100.1 with the router IP
iptables -A FORWARD -s 192.0.2.10 -d 198.51.100.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 198.51.100.1 -p tcp --dport 80 -j DROP