CVE-2026-71952 Overview
CVE-2026-71952 is a command injection vulnerability affecting D-Link DWR-M961 4G LTE routers with hardware version C1 running firmware prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formPinManageSetup interface, where the oldPIn parameter is passed to a system shell without proper sanitization. A remote attacker can inject arbitrary shell commands that execute with root privileges on the underlying operating system. The issue is classified under CWE-78 (OS Command Injection) and is exploitable over the network without authentication or user interaction.
Critical Impact
Unauthenticated remote attackers can achieve root-level command execution on affected DWR-M961 routers, resulting in full device compromise.
Affected Products
- D-Link DWR-M961 4G AC1200 LTE Router (Hardware Version C1)
- Firmware versions prior to 1.1.5_C1_202607071108
- The /boafrm/formPinManageSetup web interface handler
Discovery Timeline
- 2026-08-08 - CVE-2026-71952 published to the National Vulnerability Database
- 2026-08-08 - Last updated in NVD database
Technical Details for CVE-2026-71952
Vulnerability Analysis
The DWR-M961 router exposes a web administration interface backed by the Boa web server, a common lightweight HTTP server used in embedded Linux devices. The /boafrm/formPinManageSetup endpoint processes PIN management requests submitted through the router's configuration interface. The handler reads the oldPIn form parameter and incorporates its value into an operating system command executed by a shell.
Because the router does not validate or sanitize the parameter, attacker-supplied shell metacharacters break out of the intended command context. Injected payloads execute as root, the privilege level under which the Boa server typically runs on embedded firmware. Successful exploitation grants persistent control over the device, enabling traffic interception, DNS manipulation, botnet enrollment, and pivoting into the internal network.
Root Cause
The root cause is missing input sanitization in the handler for /boafrm/formPinManageSetup. User-controlled data flows directly from an HTTP request field into a shell command invocation without escaping, allowlisting, or use of parameterized execution APIs. This is a textbook CWE-78 defect.
Attack Vector
Exploitation requires only network reachability to the router's management interface. An attacker crafts an HTTP POST request to /boafrm/formPinManageSetup containing a malicious oldPIn value with shell metacharacters such as semicolons, backticks, or command substitution syntax. The Boa server processes the request and invokes the injected commands. No credentials or user interaction are required. See the VulnCheck D-Link DWR-M961 Advisory for additional technical detail.
Detection Methods for CVE-2026-71952
Indicators of Compromise
- HTTP POST requests targeting /boafrm/formPinManageSetup containing shell metacharacters (;, |, &, `, $()) in the oldPIn field
- Unexpected outbound connections from the router to unknown IP addresses following administrative traffic
- Unauthorized changes to router DNS settings, firewall rules, or firmware images
- Presence of new processes or persistence artifacts written to writable partitions on the device
Detection Strategies
- Inspect web server and reverse-proxy logs for requests to /boafrm/formPinManageSetup with anomalous oldPIn payloads exceeding expected PIN length or containing non-numeric characters
- Deploy network intrusion detection signatures that match command-injection patterns in HTTP request bodies destined for the router management interface
- Correlate router administrative access attempts with subsequent outbound connections to non-standard destinations using flow telemetry
Monitoring Recommendations
- Restrict management-interface exposure to trusted internal networks and monitor any WAN-side access attempts
- Forward router syslog output to a central logging platform for retention and alerting on configuration changes
- Baseline outbound traffic from the router itself and alert on deviations, since compromised embedded devices often initiate command-and-control connections
How to Mitigate CVE-2026-71952
Immediate Actions Required
- Upgrade DWR-M961 hardware version C1 devices to firmware 1.1.5_C1_202607071108 or later per the D-Link Security Advisory SAP10512
- Disable remote (WAN-side) administration on affected routers until the patch is applied
- Rotate administrative credentials and any secrets stored on the device after patching, as pre-patch compromise cannot be ruled out
- Audit device configuration for unauthorized DNS servers, port forwards, or firewall changes
Patch Information
D-Link has published firmware 1.1.5_C1_202607071108 for the DWR-M961 hardware revision C1, which addresses the command injection in the /boafrm/formPinManageSetup handler. Refer to the D-Link Security Advisory SAP10512 for firmware downloads and installation instructions. Confirm hardware revision on the device label before applying firmware, since revisions are not cross-compatible.
Workarounds
- Place the router management interface behind a network segment restricted to trusted administrative hosts using upstream access control lists
- Block inbound HTTP and HTTPS access to the router's WAN interface at the perimeter until firmware is updated
- Replace end-of-support or unpatchable units with a supported model if a firmware update cannot be applied
# Example upstream ACL: allow router management only from an admin subnet
# (adjust interface names and addresses to match the deployment)
iptables -A FORWARD -p tcp -s 10.10.20.0/24 -d 192.0.2.1 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
