CVE-2026-71947 CRITICAL CVSS 9.3 dwr_m961 Verified Advisory

Command injection in D-Link DWR-M961 traceroute diagnostic interface (CVE-2026-71947)

Command Injection D-Link Dwr M961 D Link Corporation

A command injection vulnerability exists in the `/boafrm/formTracerouteDiagnosticRun` web-management CGI interface of D-Link DWR-M961 devices (hardware revision C1). A remote attacker can inject arbitrary malicious commands via the `host` and `ipVer` fields of this interface, resulting in command execution with root privileges on the affected device. Affected versions: - Hardware revision C1 We recommend updating to: 1.1.5_C1_202607071108. CVSS 9.3 · our assessment: act_now Reference: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 Details: https://vuln.today/cve/CVE-2026-71947

Verified by vuln.today against published advisories.

Affected versions

– Hardware revision C1

Fixed in: 1.1.5_C1_202607071108

Full CVE analysis Reference Published Aug 08, 2026

More advisories for dwr_m961

← All verified advisories