CVE-2026-71956: D-Link DWR-M961 RCE Vulnerability

CVE-2026-71956 Overview

CVE-2026-71956 is a command injection vulnerability affecting D-Link DWR-M961 4G AC1200 LTE routers running hardware version C1 and software version 1.1.2_C1_202602110044. The flaw resides in the app.cgi interface, where the netDig.ping.dst parameter fails to sanitize user-supplied input before passing it to a system shell. A remote, unauthenticated attacker can inject arbitrary operating system commands that execute with root privileges. The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected DWR-M961 routers, resulting in full device compromise.

Affected Products

D-Link DWR-M961 4G AC1200 LTE Router, hardware version C1
D-Link DWR-M961 firmware version 1.1.2_C1_202602110044
The app.cgi interface exposed on affected devices

Discovery Timeline

2026-08-08 - CVE-2026-71956 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-71956

Vulnerability Analysis

The DWR-M961 exposes a web management interface implemented through CGI scripts. The app.cgi endpoint accepts a netDig.ping.dst parameter intended to hold a destination host or IP address for network diagnostics. The router passes this value to an underlying shell command without validation or neutralization of shell metacharacters. An attacker who supplies characters such as ;, &, |, or backticks appends arbitrary commands to the diagnostic invocation.

Because the CGI process executes as root on embedded Linux firmware, injected commands inherit full privileges. This grants attackers the ability to modify firmware configuration, extract credentials, pivot into internal networks, or install persistent implants. The EPSS score for this CVE is 1.738%, placing it in the 75th percentile of exploited vulnerabilities.

Root Cause

The root cause is missing input validation in the netDig.ping.dst handler within app.cgi. The handler concatenates the parameter directly into a shell command string rather than using a safe execution API or an allowlist of valid hostnames and IP addresses. This is a textbook OS command injection pattern tracked under CWE-78.

Attack Vector

Exploitation is performed over the network by sending a crafted HTTP request to the router's app.cgi endpoint. No authentication or user interaction is required. The attacker embeds shell metacharacters within the netDig.ping.dst field, and the injected payload executes as root. Because many DWR-M961 units are deployed as internet-facing LTE gateways, the management interface may be reachable from external networks depending on configuration. Full technical details are available in the VulnCheck Advisory for D-Link DWR-M961.

Detection Methods for CVE-2026-71956

Indicators of Compromise

HTTP POST or GET requests to /app.cgi containing shell metacharacters such as ;, &&, |, or backticks in the netDig.ping.dst parameter
Outbound connections initiated by the router to unexpected external hosts shortly after receiving app.cgi requests
Unexpected new processes, cron entries, or modifications to /etc on the device following administrative traffic

Detection Strategies

Inspect web server and reverse-proxy logs for requests to app.cgi that include URL-encoded shell separators in the netDig.ping.dst field
Deploy network intrusion detection signatures that flag ping-diagnostic parameters containing non-hostname characters
Correlate router management-interface access with subsequent anomalous DNS or egress traffic from the same device

Monitoring Recommendations

Restrict and monitor administrative access to the router's LAN and WAN management interfaces
Alert on any HTTP traffic to /app.cgi originating from untrusted networks or unexpected internal hosts
Baseline outbound traffic from LTE gateway devices and investigate deviations that suggest command-and-control activity

How to Mitigate CVE-2026-71956

Immediate Actions Required

Disable remote (WAN-side) management on the DWR-M961 until a vendor fix is available
Restrict LAN-side access to the web management interface to a dedicated administrative subnet
Rotate administrative credentials and review router configuration for unauthorized changes
Isolate affected devices from sensitive internal networks where feasible

Patch Information

Refer to the D-Link Security Advisory SAP10512 for current firmware availability and vendor guidance for the DWR-M961. Product details are published on the D-Link Product Page for DWR-M961. Apply vendor-supplied firmware updates as soon as they are released.

Workarounds

Block inbound access to TCP ports serving the router's web management interface at upstream firewalls
Place the router behind a network segment that enforces access control lists restricting who can reach app.cgi
Deploy a web application firewall rule that drops requests to /app.cgi containing shell metacharacters in query or body parameters

bash

# Example upstream firewall rule to block WAN access to the management interface
iptables -I INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -I INPUT -i wan0 -p tcp --dport 443 -j DROP