Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 11 total.
Command injection in D-Link DWR-M961 web management CGI (CVE-2026-71955)
D-Link DWR-M961 devices with hardware revision C1 contain a command injection vulnerability in the /boafrm/formWsc web management interface. A remote attacker can inject arbitrary commands through the localPin field, ...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 L2TPv3 configuration interface (CVE-2026-71954)
The D-Link DWR-M961 router (hardware revision C1) contains a command injection vulnerability in the `/boafrm/formL2tpv3ConfigSetup` web management interface. A remote attacker can inject arbitrary malicious commands v...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 NTP configuration interface (CVE-2026-71953)
D-Link DWR-M961 devices (hardware revision C1) contain a command injection vulnerability in the /boafrm/formNtp web management interface. A remote attacker can inject arbitrary malicious commands via the ntpServerIp1 ...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71952)
A command injection vulnerability exists in the `/boafrm/formPinManageSetup` interface of D-Link DWR-M961 devices with hardware revision C1. A remote attacker can inject arbitrary malicious commands via the `oldPIn` f...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 formIMEISetup interface (CVE-2026-71951)
D-Link DWR-M961 devices with hardware revision C1 contain a command injection vulnerability in the /boafrm/formIMEISetup web management interface. A remote attacker can inject arbitrary malicious commands into the IME...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71950)
A command injection vulnerability exists in the `/boafrm/formSmsManage` interface of D-Link DWR-M961 devices with hardware revision C1. A remote attacker can inject arbitrary malicious commands via the `action_value` ...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71949)
D-Link DWR-M961 devices (hardware revision C1) contain a command injection vulnerability in the /boafrm/formUSSDSetup web management interface. A remote attacker can inject arbitrary commands through the ussdValue and...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71948)
D-Link DWR-M961 devices (hardware revision C1) contain a command injection vulnerability in the `/boafrm/formDebugDiagnosticRun` web management CGI interface. A remote attacker can inject arbitrary malicious commands ...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 web management interface (CVE-2026-71944)
D-Link DWR-M961 devices (hardware revision C1) contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel web management interface. A remote attacker can inject arbitrary commands via the fota_...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 Fibocom FOTA upgrade handler (CVE-2026-71945)
A command injection vulnerability exists in the Fibocom firmware-over-the-air upgrade handler of D-Link DWR-M961 devices (hardware revision C1). A remote attacker can inject arbitrary malicious commands via the `fota_...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 ping diagnostic interface (CVE-2026-71946)
A command injection vulnerability exists in the `/boafrm/formPingDiagnosticRun` web management interface of the D-Link DWR-M961 (hardware revision C1). A remote attacker can inject arbitrary malicious commands via the...
Fixed in 1.1.5_C1_202607071108