Command injection in D-Link DWR-M961 web management interface (CVE-2026-71944)

D-Link DWR-M961 devices (hardware revision C1) contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel web management interface. A remote attacker can inject arbitrary commands via the fota_url parameter, resulting in execution with root privileges. This is one of 18 numbered vulnerability findings addressed in the same firmware update, also including buffer overflow vulnerabilities across multiple CGI components. Affected versions: - Hardware revision C1 - firmware 1.1.2_C1_202602110044 We recommend updating to: 1.1.5_C1_202607071108. CVSS 9.3 · our assessment: act_now Reference: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 Details: https://vuln.today/cve/CVE-2026-71944