CVE-2026-71955
CRITICAL
CVSS 9.3
Dwr M961
Verified Advisory
Command injection in D-Link DWR-M961 web management CGI (CVE-2026-71955)
D-Link DWR-M961 devices with hardware revision C1 contain a command injection vulnerability in the /boafrm/formWsc web management interface. A remote attacker can inject arbitrary commands through the localPin field, resulting in command execution with root privileges on the affected device.
Affected versions:
- Hardware version C1
We recommend updating to: 1.1.5_C1_202607071108.
CVSS 9.3 · our assessment: act_now
Reference: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512
Details: https://vuln.today/cve/CVE-2026-71955
Verified by vuln.today against published advisories.
Affected versions
- – Hardware version C1
Fixed in: 1.1.5_C1_202607071108
More advisories for Dwr M961
- CVE-2026-71954 – Command injection in D-Link DWR-M961 L2TPv3 configuration interface (CVE-2026-71954)
- CVE-2026-71953 – Command injection in D-Link DWR-M961 NTP configuration interface (CVE-2026-71953)
- CVE-2026-71952 – Command injection in D-Link DWR-M961 web management interface (CVE-2026-71952)
- CVE-2026-71951 – Command injection in D-Link DWR-M961 formIMEISetup interface (CVE-2026-71951)
- CVE-2026-71950 – Command injection in D-Link DWR-M961 web management interface (CVE-2026-71950)
- CVE-2026-71949 – Command injection in D-Link DWR-M961 web management interface (CVE-2026-71949)
- CVE-2026-71948 – Command injection in D-Link DWR-M961 web management interface (CVE-2026-71948)
- CVE-2026-71944 – Command injection in D-Link DWR-M961 web management interface (CVE-2026-71944)