CVE-2026-71948
CRITICAL
CVSS 9.3
Dwr M961
Verified Advisory
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71948)
D-Link DWR-M961 devices (hardware revision C1) contain a command injection vulnerability in the `/boafrm/formDebugDiagnosticRun` web management CGI interface. A remote attacker can inject arbitrary malicious commands via the `host` field, resulting in command execution with root privileges on the affected device.
Affected versions:
- Hardware revision C1
We recommend updating to: 1.1.5_C1_202607071108.
CVSS 9.3 · our assessment: act_now
Reference: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512
Details: https://vuln.today/cve/CVE-2026-71948
Verified by vuln.today against published advisories.
Affected versions
- – Hardware revision C1
Fixed in: 1.1.5_C1_202607071108
More advisories for Dwr M961
- CVE-2026-71955 – Command injection in D-Link DWR-M961 web management CGI (CVE-2026-71955)
- CVE-2026-71954 – Command injection in D-Link DWR-M961 L2TPv3 configuration interface (CVE-2026-71954)
- CVE-2026-71953 – Command injection in D-Link DWR-M961 NTP configuration interface (CVE-2026-71953)
- CVE-2026-71952 – Command injection in D-Link DWR-M961 web management interface (CVE-2026-71952)
- CVE-2026-71951 – Command injection in D-Link DWR-M961 formIMEISetup interface (CVE-2026-71951)
- CVE-2026-71950 – Command injection in D-Link DWR-M961 web management interface (CVE-2026-71950)
- CVE-2026-71949 – Command injection in D-Link DWR-M961 web management interface (CVE-2026-71949)
- CVE-2026-71944 – Command injection in D-Link DWR-M961 web management interface (CVE-2026-71944)