CVE-2026-71955: D-Link DWR-M961 RCE Vulnerability

CVE-2026-71955 Overview

CVE-2026-71955 is a command injection vulnerability [CWE-78] affecting D-Link DWR-M961 4G LTE routers running hardware version C1 with software version 1.1.2_C1_202602110044. The flaw resides in the /boafrm/formWsc interface, which handles Wi-Fi Protected Setup (WPS) configuration requests. A remote unauthenticated attacker can inject shell metacharacters into the localPin, targetAPSsid, peerPin, and peerRptPin parameters. Successful exploitation results in arbitrary command execution with root privileges on the underlying embedded Linux system.

Critical Impact
Unauthenticated remote attackers can achieve root-level command execution on affected D-Link DWR-M961 routers, enabling full device takeover, traffic interception, and lateral movement into connected networks.

Affected Products

D-Link DWR-M961 4G AC1200 LTE Router (Hardware Version C1)
Firmware / Software Version 1.1.2_C1_202602110044
Devices exposing the web management interface at /boafrm/formWsc

Discovery Timeline

2026-08-08 - CVE-2026-71955 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71955

Vulnerability Analysis

The DWR-M961 web management interface is served by the boa embedded web server, which routes form submissions through handlers prefixed with /boafrm/. The formWsc handler processes WPS enrollment parameters submitted by the user. Instead of validating or sanitizing the input, the handler passes several fields directly into a shell command executed by the underlying operating system.

Because the router runs its web services as root, any injected command inherits full system privileges. An attacker can chain commands using shell metacharacters such as ;, |, &&, or backticks. This yields persistent access, credential theft, DNS hijacking, or use of the device as a pivot into the internal network.

The attack requires only network reachability to the router's management interface. No authentication is required to reach the vulnerable endpoint, which amplifies exposure on devices where remote management is enabled or where the LAN-side interface is accessible to untrusted clients.

Root Cause

The root cause is missing input sanitization in the formWsc handler. User-supplied values for localPin, targetAPSsid, peerPin, and peerRptPin are concatenated into a system command string and executed via a shell interpreter, matching the classic OS Command Injection pattern described in CWE-78.

Attack Vector

An attacker sends a crafted HTTP POST request to /boafrm/formWsc containing shell metacharacters within any of the four vulnerable fields. The boa process expands the metacharacters and executes attacker-controlled commands as root. Technical details are documented in the VulnCheck Advisory: D-Link DWR-M961.

No verified public proof-of-concept code is included in this advisory. Refer to the linked advisories for reproduction details.

Detection Methods for CVE-2026-71955

Indicators of Compromise

Unexpected POST requests to /boafrm/formWsc containing shell metacharacters such as ;, |, &, $(, or backticks within localPin, targetAPSsid, peerPin, or peerRptPin parameters.
New or unknown processes spawned by the boa web server, especially shells (sh, busybox sh) or network utilities (wget, curl, tftp, nc).
Outbound connections from the router to unfamiliar hosts, indicative of payload staging or reverse shells.
Unauthorized modifications to /etc/, iptables rules, or DNS resolver configuration on the device.

Detection Strategies

Inspect HTTP traffic destined for the router management interface for WPS form submissions containing shell metacharacters in WPS PIN or SSID fields.
Deploy network intrusion detection signatures that match POST /boafrm/formWsc requests with non-numeric characters in localPin, peerPin, or peerRptPin values, since valid PINs are numeric only.
Correlate router configuration changes with authentication events to identify changes made without a preceding admin login.

Monitoring Recommendations

Log and alert on all administrative HTTP requests to DWR-M961 devices, including source IP, User-Agent, and request body when policy permits.
Monitor DNS query patterns from client hosts behind DWR-M961 routers for evidence of DNS hijacking or resolver redirection.
Track firmware version reporting via network inventory to identify unpatched DWR-M961 units running 1.1.2_C1_202602110044.

How to Mitigate CVE-2026-71955

Immediate Actions Required

Disable remote (WAN-side) management on all DWR-M961 devices until a vendor patch is applied.
Restrict LAN-side access to the router web interface to a dedicated management VLAN or a small set of administrator hosts.
Rotate router administrator credentials and Wi-Fi pre-shared keys after confirming the device is not already compromised.
Review router configuration for unauthorized DNS servers, port forwards, or firewall rules and revert unexpected changes.

Patch Information

D-Link tracks this issue under advisory D-Link Security Advisory SAP10512. Administrators should consult the advisory for the current fixed firmware release and apply it as soon as it becomes available. Product details for the affected model are provided on the D-Link Product Overview page.

Workarounds

Block inbound HTTP and HTTPS traffic to the router's WAN interface using an upstream firewall or ISP-managed access control list.
Place the DWR-M961 behind an additional perimeter device that terminates management traffic and denies direct access to /boafrm/ endpoints.
If WPS functionality is not required, disable WPS on the device to reduce the operational relevance of the vulnerable handler, noting that the endpoint may remain reachable regardless.
Replace end-of-support or unpatchable units with hardware that continues to receive vendor security updates.

bash

# Example upstream firewall rule to block WAN access to the router's web UI
# (adapt interface names and router IP to the local environment)
iptables -A FORWARD -p tcp -d <ROUTER_WAN_IP> --dport 80  -j DROP
iptables -A FORWARD -p tcp -d <ROUTER_WAN_IP> --dport 443 -j DROP