CVE-2026-71957 Overview
CVE-2026-71957 is a buffer overflow vulnerability affecting D-Link DWR-M961 4G LTE routers with hardware version C1 running software version 1.1.2_C1_202602110044. The flaw resides in the app.cgi interface, where the netAcc.addlist[].name field fails to enforce length bounds on user-supplied input. A remote unauthenticated attacker can send an overly long string to trigger memory corruption. Depending on payload construction, exploitation results in arbitrary command execution on the device or a denial-of-service crash. The weakness is classified as [CWE-120] Buffer Copy without Checking Size of Input.
Critical Impact
Remote unauthenticated attackers can execute arbitrary commands or crash affected D-Link DWR-M961 routers by sending a crafted HTTP request to app.cgi.
Affected Products
- D-Link DWR-M961 4G AC1200 LTE Router
- Hardware version: C1
- Software version: 1.1.2_C1_202602110044
Discovery Timeline
- 2026-08-08 - CVE-2026-71957 published to NVD
- 2026-08-08 - Last updated in NVD database
Technical Details for CVE-2026-71957
Vulnerability Analysis
The vulnerability exists in the app.cgi handler on the D-Link DWR-M961 router's web management interface. The handler processes the netAcc.addlist[].name parameter without validating input length before copying it into a fixed-size stack buffer. When an attacker submits a string exceeding the destination buffer's capacity, adjacent memory is overwritten. This corruption can overwrite the saved return address on the stack, redirecting execution flow. A carefully crafted payload allows the attacker to execute arbitrary commands in the context of the web server process, which typically runs with elevated privileges on embedded router firmware. A less precise payload will corrupt critical control data and force a device crash, disrupting network connectivity for all connected clients. See the VulnCheck D-Link DWR-M961 Advisory for additional analysis.
Root Cause
The root cause is missing bounds checking on the netAcc.addlist[].name field in app.cgi. The firmware uses unsafe string handling routines that do not enforce a maximum length before writing input to a stack-allocated buffer, matching the [CWE-120] pattern.
Attack Vector
Exploitation requires network access to the router's HTTP management interface. No authentication or user interaction is needed. The attacker crafts an HTTP request targeting app.cgi with an oversized netAcc.addlist[].name value and delivers it directly to the device. Where the management interface is exposed to the internet, remote attackers can reach vulnerable devices without prior compromise.
No verified public exploit code is available. Refer to the D-Link Security Advisory SAP10512 for vendor guidance.
Detection Methods for CVE-2026-71957
Indicators of Compromise
- HTTP POST requests to /app.cgi containing abnormally long values in the netAcc.addlist[].name parameter.
- Unexpected reboots, watchdog resets, or web management interface unavailability on DWR-M961 devices.
- Outbound connections from the router to unfamiliar destinations following suspicious HTTP traffic.
- New processes or shell activity spawned by the router web server process.
Detection Strategies
- Inspect HTTP traffic to the router's management interface for oversized parameter values in app.cgi requests.
- Deploy IDS/IPS signatures that flag parameter lengths exceeding reasonable thresholds for netAcc.addlist[].name.
- Correlate router configuration changes with the source IP addresses submitting them to identify unauthorized modifications.
Monitoring Recommendations
- Log all administrative access to the DWR-M961 web interface and alert on requests from non-management network segments.
- Monitor router health metrics for anomalous CPU usage, memory pressure, or unexpected reboots.
- Restrict management interface exposure and audit any WAN-facing access to the router's HTTP service.
How to Mitigate CVE-2026-71957
Immediate Actions Required
- Disable remote (WAN-side) HTTP administration on all DWR-M961 devices until a patched firmware release is applied.
- Restrict LAN-side access to the management interface using ACLs or a dedicated management VLAN.
- Change default administrator credentials and enforce strong passwords to reduce risk from secondary attacks.
- Inventory affected devices by hardware revision and software version, prioritizing internet-exposed units.
Patch Information
Refer to the D-Link Security Advisory SAP10512 for official patch availability and firmware download instructions. Consult the D-Link DWR-M961 Product Page for supported firmware releases specific to hardware version C1.
Workarounds
- Block inbound access to TCP ports used by the router's HTTP management service at the upstream firewall.
- Place the router behind a network segment that permits management only from trusted administrator hosts.
- Where feasible, replace end-of-support DWR-M961 hardware with a supported model that receives current security updates.
# Example: block WAN-side access to the router HTTP management interface
iptables -I INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -I INPUT -i wan0 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
