Command injection in D-Link DWR-M961 Fibocom FOTA upgrade handler (CVE-2026-71945)

A command injection vulnerability exists in the Fibocom firmware-over-the-air upgrade handler of D-Link DWR-M961 devices (hardware revision C1). A remote attacker can inject arbitrary malicious commands via the `fota_url` field of the `/boafrm/formLtefotaUpgradeFibocom` interface. Successful exploitation results in command execution with root privileges. Affected versions: - Hardware version C1 We recommend updating to: 1.1.5_C1_202607071108. CVSS 9.3 · our assessment: act_now Reference: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 Details: https://vuln.today/cve/CVE-2026-71945