CVE-2026-71950: D-Link DWR-M961 RCE Vulnerability

CVE-2026-71950 Overview

CVE-2026-71950 is a command injection vulnerability affecting D-Link DWR-M961 4G AC1200 LTE routers with hardware version C1 running firmware prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formSmsManage web interface, which fails to sanitize input passed through the action_value parameter. A remote attacker can inject arbitrary operating system commands that execute with root privileges on the device. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root, gaining full control of affected DWR-M961 routers and any traffic traversing them.

Affected Products

D-Link DWR-M961 4G AC1200 LTE Router, hardware revision C1
Firmware versions prior to 1.1.5_C1_202607071108
Deployments exposing the router web administration interface to untrusted networks

Discovery Timeline

2026-08-08 - CVE-2026-71950 published to the National Vulnerability Database
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71950

Vulnerability Analysis

The DWR-M961 web management interface is served by the boa HTTP daemon, which exposes handler endpoints under the /boafrm/ path. The formSmsManage handler processes SMS management requests submitted by an administrator. According to the VulnCheck advisory, the action_value field submitted to this handler is concatenated into a shell command without adequate validation or escaping. An attacker who reaches the interface over the network can append shell metacharacters and secondary commands to action_value, which the underlying shell then interprets. Because the boa process runs as root on embedded D-Link firmware, injected commands execute with the highest privilege level available on the device.

Root Cause

The root cause is missing input neutralization ([CWE-78]) in the formSmsManage handler. User-controlled data flows directly into a system command invocation, allowing shell metacharacters such as ;, |, &&, and backticks to break out of the intended argument context. No parameterization or allowlist validation is applied before the string is passed to the shell.

Attack Vector

Exploitation requires network reachability to the router's HTTP administration interface. An attacker crafts an HTTP POST request to /boafrm/formSmsManage containing a malicious action_value payload that includes command separators followed by arbitrary shell instructions. Because the CVSS vector indicates no authentication is required, attackers can weaponize this against devices that expose administration to the WAN or to lateral attackers on the LAN. Successful exploitation yields root-level command execution, enabling firmware modification, credential theft, traffic interception, and persistence for follow-on operations.

No verified public proof-of-concept code is referenced in the advisory. See the D-Link Security Advisory SAP10512 for vendor technical details.

Detection Methods for CVE-2026-71950

Indicators of Compromise

HTTP POST requests to /boafrm/formSmsManage containing shell metacharacters (;, |, &, `, $() in the action_value parameter
Unexpected outbound connections originating from the router management plane to attacker-controlled infrastructure
New or modified files under /tmp, /var, or writable firmware partitions on the device
Router configuration changes, new administrative accounts, or altered DNS settings that were not made by authorized personnel

Detection Strategies

Inspect web server and reverse-proxy logs in front of router management interfaces for requests to /boafrm/formSmsManage from unexpected source addresses
Deploy network intrusion detection signatures that match command injection patterns in POST bodies targeting boafrm endpoints
Baseline router firmware versions across the fleet and alert on any DWR-M961 C1 running firmware older than 1.1.5_C1_202607071108

Monitoring Recommendations

Forward router syslog and NetFlow telemetry to a central analytics platform for anomaly review
Monitor for administrative interface exposure on WAN interfaces using external attack surface scans
Alert on unusual DNS or outbound HTTP traffic patterns from routers that could indicate command-and-control activity following exploitation

How to Mitigate CVE-2026-71950

Immediate Actions Required

Upgrade DWR-M961 C1 devices to firmware version 1.1.5_C1_202607071108 or later as published in D-Link Security Advisory SAP10512
Restrict access to the router administration interface to trusted management VLANs and disable WAN-side administration
Rotate all administrative credentials on affected devices after patching, in case exploitation preceded remediation
Audit configuration, DNS settings, and firmware integrity on any device that may have been exposed

Patch Information

D-Link has released firmware 1.1.5_C1_202607071108 for the DWR-M961 hardware revision C1 that remediates the command injection in formSmsManage. Refer to the D-Link Security Advisory SAP10512 and the D-Link DWR-M961 product page for downloads and installation instructions.

Workarounds

Block inbound access to TCP ports 80 and 443 on the WAN interface until firmware can be applied
Place affected routers behind an upstream firewall that filters requests to /boafrm/formSmsManage from untrusted sources
Segment management traffic onto a dedicated administrative network unreachable from user or guest subnets
Disable the SMS management feature where not required by operational workflows

bash

# Example upstream firewall rule to block external access to the vulnerable endpoint
iptables -I FORWARD -p tcp --dport 80 -d <router_ip> \
  -m string --algo bm --string "/boafrm/formSmsManage" -j DROP