CVE-2026-71954 Overview
CVE-2026-71954 is a command injection vulnerability affecting D-Link DWR-M961 4G AC1200 LTE routers with hardware version C1 running firmware prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formL2tpv3ConfigSetup interface, where the tunnelid and sessionid parameters fail to sanitize user-supplied input before passing it to system command execution. A remote, unauthenticated attacker can inject arbitrary shell commands that execute with root privileges. The vulnerability is classified under [CWE-78] (OS Command Injection) and carries a CVSS 4.0 base score of 9.3.
Critical Impact
Remote attackers can achieve unauthenticated root-level command execution on affected D-Link DWR-M961 routers, enabling full device takeover, traffic interception, and pivoting into internal networks.
Affected Products
- D-Link DWR-M961 4G AC1200 LTE Router (hardware version C1)
- Firmware versions prior to 1.1.5_C1_202607071108
- Deployments exposing the device web management interface to untrusted networks
Discovery Timeline
- 2026-08-08 - CVE-2026-71954 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-71954
Vulnerability Analysis
The vulnerability exists in the router's embedded Boa web server, specifically within the handler for the /boafrm/formL2tpv3ConfigSetup endpoint. This endpoint processes configuration requests for Layer 2 Tunneling Protocol version 3 (L2TPv3) tunnels. The handler accepts tunnelid and sessionid parameters from HTTP POST requests and incorporates them into system-level commands without sanitization or input validation.
Because the Boa server runs as the root user on the DWR-M961, any injected command inherits root privileges. Successful exploitation grants full control over the device, including the ability to modify firmware, extract credentials, alter DNS or routing settings, and use the router as a foothold into the connected network.
Root Cause
The underlying defect is unsafe concatenation of untrusted HTTP parameter values into shell command strings. The formL2tpv3ConfigSetup handler treats tunnelid and sessionid as numeric identifiers but performs no type enforcement or metacharacter filtering. Shell metacharacters such as ;, |, &&, and backticks are passed directly to the command interpreter, breaking the intended command boundary.
Attack Vector
Exploitation requires network access to the router's HTTP management interface. An attacker sends a crafted POST request to /boafrm/formL2tpv3ConfigSetup containing shell metacharacters and arbitrary commands in the tunnelid or sessionid fields. No authentication or user interaction is required. The injected payload executes with root privileges within the router's operating system.
A sanitized description of the request pattern involves an HTTP POST to the vulnerable endpoint with a body containing tunnelid=1;<command> or sessionid=1;<command>. Refer to the VulnCheck D-Link DWR-M961 Advisory for the full technical breakdown.
Detection Methods for CVE-2026-71954
Indicators of Compromise
- HTTP POST requests to /boafrm/formL2tpv3ConfigSetup containing shell metacharacters (;, |, &, `, $() in the tunnelid or sessionid parameters
- Unexpected outbound connections from the router to unknown external hosts, particularly on non-standard ports
- Unauthorized modifications to router configuration, DNS settings, or firmware images
- New processes spawned by the Boa web server (boa) that are not part of the stock firmware
Detection Strategies
- Inspect web server access logs on the router or upstream network proxies for POST requests targeting the formL2tpv3ConfigSetup endpoint from untrusted sources
- Deploy network intrusion detection signatures that match shell metacharacters in HTTP POST bodies destined for /boafrm/ URIs
- Correlate router administrative interface access with source IP reputation and geolocation to identify anomalous management traffic
Monitoring Recommendations
- Continuously monitor SNMP or syslog output from the DWR-M961 for unexpected reboots, configuration changes, or new user accounts
- Baseline outbound traffic from the router and alert on deviations, especially connections to command-and-control infrastructure
- Track firmware version reporting across the fleet to confirm patch adoption
How to Mitigate CVE-2026-71954
Immediate Actions Required
- Upgrade all D-Link DWR-M961 (hardware C1) devices to firmware 1.1.5_C1_202607071108 or later as published in the D-Link Security Advisory SAP10512
- Restrict access to the router's web management interface to trusted internal networks only; block WAN-side administrative access
- Audit the device for signs of prior compromise, including unexpected processes, configuration changes, and outbound connections
Patch Information
D-Link has released firmware version 1.1.5_C1_202607071108 for the DWR-M961 (hardware C1) that addresses the command injection flaw. The fix is available through the vendor advisory at D-Link Security Advisory SAP10512. Product details are available on the D-Link Product Page for DWR-M961.
Workarounds
- Disable remote management on the WAN interface until the firmware update is applied
- Place the router behind a network segment that restricts access to the HTTP management interface via ACLs or firewall rules
- Rotate all administrative credentials and pre-shared keys after patching, since prior root-level compromise cannot be ruled out
- If the device cannot be patched promptly, consider replacing it with a supported model that receives active security updates
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
