CVE-2026-71956 CRITICAL CVSS 9.3 dwr_m961 Verified Advisory

Command injection in D-Link DWR-M961 app.cgi interface (CVE-2026-71956)

Command Injection D-Link Dwr M961 D Link Corporation

The D-Link DWR-M961 (hardware revision C1, firmware 1.1.2_C1_202602110044) contains a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands via the netDig.ping.dst field, resulting in command execution with root privileges on the affected device. Affected versions: - Hardware revision C1 - firmware version 1.1.2_C1_202602110044 We recommend updating to: 1.1.5_C1_202607071108. CVSS 9.3 · our assessment: act_now Reference: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 Details: https://vuln.today/cve/CVE-2026-71956

Verified by vuln.today against published advisories.

Affected versions

– Hardware revision C1
– firmware version 1.1.2_C1_202602110044

Fixed in: 1.1.5_C1_202607071108

Full CVE analysis Reference Published Aug 08, 2026

More advisories for dwr_m961

← All verified advisories