CVE-2026-71951: D-Link DWR-M961 RCE Vulnerability

CVE-2026-71951 Overview

CVE-2026-71951 is a command injection vulnerability affecting D-Link DWR-M961 4G LTE routers with hardware version C1 running firmware prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formIMEISetup web interface, where the IMEI_value parameter is passed to a shell context without adequate sanitization. A remote, unauthenticated attacker can inject arbitrary operating system commands that execute with root privileges on the device. The issue is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Unauthenticated remote attackers can achieve root-level command execution on affected D-Link DWR-M961 routers over the network.

Affected Products

D-Link DWR-M961 4G AC1200 LTE Router (hardware version C1)
Firmware versions prior to 1.1.5_C1_202607071108
Devices exposing the web management interface to untrusted networks

Discovery Timeline

2026-08-08 - CVE-2026-71951 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-71951

Vulnerability Analysis

The DWR-M961 web management daemon exposes the /boafrm/formIMEISetup endpoint to configure the modem's International Mobile Equipment Identity (IMEI) value. The handler accepts the IMEI_value field from HTTP POST requests and forwards the string to a system shell without applying input validation or output encoding. Because the value is concatenated into a shell command, an attacker who supplies shell metacharacters can break out of the intended argument context and append arbitrary commands. The boa web server on this device runs as root, so injected commands inherit full administrative privileges over the router's Linux userland.

Root Cause

The root cause is improper neutralization of special elements passed to an OS command [CWE-78]. The firmware trusts user-supplied form input for a field that is subsequently reused in a shell invocation, most likely through a system() or popen() style call. Neither a strict allowlist for IMEI digits nor argument-safe execution APIs were applied before the vendor patch.

Attack Vector

Exploitation requires network reachability to the router's HTTP management interface and no authentication or user interaction. An attacker submits a crafted POST request to /boafrm/formIMEISetup with a malicious IMEI_value payload containing shell separators such as backticks, semicolons, or command substitution syntax. The injected commands run as root, enabling firmware modification, credential extraction, persistent implants, traffic interception, and pivoting into the internal network.

A sanitized description of the exploitation flow: the attacker issues an HTTP POST to the vulnerable endpoint, sets IMEI_value to a benign digit string followed by a shell command separator and an arbitrary command, and observes the injected command executing on the device. See the VulnCheck D-Link Command Injection Advisory for the detailed technical write-up.

Detection Methods for CVE-2026-71951

Indicators of Compromise

HTTP POST requests to /boafrm/formIMEISetup from external or untrusted source addresses.
IMEI_value parameter contents containing shell metacharacters such as ;, |, &, $(, or backticks.
Unexpected outbound connections initiated by the router to attacker-controlled infrastructure.
Modified firmware artifacts, new cron entries, or unfamiliar processes running as root on the router.

Detection Strategies

Inspect HTTP request bodies destined for the router management interface for non-numeric characters within IMEI_value.
Alert on management-plane traffic to /boafrm/formIMEISetup originating from outside authorized administrative subnets.
Correlate router-originated DNS queries and outbound TCP sessions against known-good baselines for management devices.

Monitoring Recommendations

Forward router syslog, HTTP access logs, and NetFlow data to a centralized analytics platform for retention and correlation.
Baseline firmware versions and configuration files, then alert on unexpected drift on the DWR-M961 fleet.
Monitor for repeated 200-response POSTs to /boafrm/formIMEISetup that precede anomalous outbound traffic.

How to Mitigate CVE-2026-71951

Immediate Actions Required

Upgrade all D-Link DWR-M961 C1 devices to firmware 1.1.5_C1_202607071108 or later as published by the vendor.
Restrict access to the router's web management interface so that only trusted management subnets can reach it.
Disable remote WAN-side administration until the patched firmware is confirmed installed.
Rotate administrative credentials and inspect device configuration for unauthorized changes after patching.

Patch Information

D-Link has released fixed firmware documented in D-Link Security Publication SAP10512. Product details for the affected router are available on the D-Link DWR-M961 product page. Administrators should validate firmware integrity after the upgrade and reboot the device to ensure the patched binaries are active.

Workarounds

Place the router behind an upstream firewall that filters inbound HTTP and HTTPS to the management interface.
Bind the management interface to the LAN only and block WAN-side access via ACLs where the firmware supports it.
Segment IoT and edge routers onto dedicated VLANs with egress filtering to limit blast radius if the device is compromised.

bash

# Example upstream firewall rule to restrict router management access
# Replace 203.0.113.10 with the router IP and 10.0.0.0/24 with the trusted admin subnet
iptables -A FORWARD -p tcp -d 203.0.113.10 --dport 80  -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 203.0.113.10 --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 203.0.113.10 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 203.0.113.10 --dport 443 -j DROP