Buffer overflow in D-Link DWR-M961 quicksetup.cgi interface (CVE-2026-71958)

A buffer overflow vulnerability exists in the quicksetup.cgi web-management interface of D-Link DWR-M961 devices (hardware revision C1, firmware 1.1.2_C1_202602110044). A remote attacker can write overly long strings to the test4, ssid2, and username fields by crafting a specific payload, enabling arbitrary command execution or causing the device to crash. Affected versions: - Hardware version C1 - firmware 1.1.2_C1_202602110044 We recommend updating to: 1.1.5_C1_202607071108. CVSS 9.3 · our assessment: act_now Reference: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512 Details: https://vuln.today/cve/CVE-2026-71958