CVE-2026-71953 Overview
CVE-2026-71953 is a command injection vulnerability [CWE-78] in the D-Link DWR-M961 4G AC1200 LTE router. The flaw affects hardware version C1 running firmware earlier than 1.1.5_C1_202607071108. The /boafrm/formNtp web interface fails to sanitize the ntpServerIp1 parameter before passing it to a shell context. A remote, unauthenticated attacker can inject arbitrary commands that execute with root privileges on the device. Successful exploitation grants full control over the router, including traffic interception, configuration tampering, and pivoting into internal networks.
Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected DWR-M961 routers by injecting shell metacharacters into the NTP configuration interface.
Affected Products
- D-Link DWR-M961 4G AC1200 LTE Router (hardware revision C1)
- Firmware versions prior to 1.1.5_C1_202607071108
- Devices exposing the web management interface to untrusted networks
Discovery Timeline
- 2026-08-08 - CVE-2026-71953 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-71953
Vulnerability Analysis
The DWR-M961 embeds a boa-based HTTP daemon that exposes administrative form handlers under the /boafrm/ path. The formNtp handler processes NTP server configuration submitted through the router's web UI. The handler accepts user-controlled values, including ntpServerIp1, and incorporates them into a system command executed by the underlying shell. Because the parameter is not validated or escaped, attackers can append shell metacharacters such as ;, |, or backticks to break out of the intended argument and execute arbitrary commands.
The boa daemon runs as root on this platform, so injected commands inherit root privileges. An attacker gaining root shell access can modify firmware, extract stored credentials, install persistent implants, hijack DNS resolution, or intercept LAN traffic.
Root Cause
The root cause is missing input sanitization in the formNtp handler. The firmware concatenates the ntpServerIp1 field directly into a command string invoked through a shell interpreter. No allowlist validation confirms the field contains a valid IPv4 address or hostname, and no escaping is applied before shell execution.
Attack Vector
Exploitation requires network reachability to the router's HTTP management interface. An unauthenticated attacker submits a crafted POST request to /boafrm/formNtp with a malicious payload in the ntpServerIp1 parameter. The injected shell command executes when the daemon processes the form. Refer to the VulnCheck Advisory and the D-Link Security Advisory SAP10512 for additional technical details.
Detection Methods for CVE-2026-71953
Indicators of Compromise
- HTTP POST requests to /boafrm/formNtp containing shell metacharacters (;, |, &, backticks, $()) in the ntpServerIp1 field
- Unexpected outbound connections from the router to attacker-controlled infrastructure following NTP configuration changes
- Unauthorized modifications to /etc/ configuration files, DNS resolver settings, or firewall rules on the device
- New processes spawned by the boa HTTP daemon that do not correspond to normal router operations
Detection Strategies
- Inspect network traffic for HTTP requests targeting /boafrm/formNtp from untrusted sources or with payloads that do not resemble valid IP addresses
- Correlate router configuration changes with the source IP that submitted them to identify unauthenticated modifications
- Monitor DNS traffic from LAN clients for redirection to unfamiliar resolvers, which can indicate post-exploitation tampering
Monitoring Recommendations
- Enable syslog forwarding from the router to a centralized log collector and alert on management interface access from WAN
- Track firmware version reporting across the fleet to identify devices still running versions prior to 1.1.5_C1_202607071108
- Baseline expected NTP server values and alert on deviations that include non-IP characters
How to Mitigate CVE-2026-71953
Immediate Actions Required
- Upgrade DWR-M961 C1 devices to firmware 1.1.5_C1_202607071108 or later as published in D-Link Security Advisory SAP10512
- Disable remote (WAN-side) HTTP management on all affected routers until patching is complete
- Rotate administrative credentials and any secrets stored on the device after patching, in case the router was already compromised
Patch Information
D-Link released fixed firmware 1.1.5_C1_202607071108 for the DWR-M961 hardware revision C1. Apply the update through the router's firmware upgrade interface using the image published on the D-Link product page. Verify the installed version after reboot to confirm the fix is active.
Workarounds
- Restrict access to the router's web management interface to trusted LAN segments using ACLs
- Place vulnerable devices behind an upstream firewall that blocks inbound HTTP and HTTPS to the router's WAN interface
- Segment IoT and management networks to limit lateral movement if a device is compromised
# Example firewall rule to block WAN-side access to the router management interface
iptables -I INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -I INPUT -i wan0 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
