Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 4 total.
Command injection in D-Link DWR-M961 app.cgi interface (CVE-2026-71956)
The D-Link DWR-M961 (hardware revision C1, firmware 1.1.2_C1_202602110044) contains a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands via the netDig....
Fixed in 1.1.5_C1_202607071108
Buffer overflow in D-Link DWR-M961 app.cgi interface (CVE-2026-71957)
The D-Link DWR-M961 (hardware revision C1, firmware 1.1.2_C1_202602110044) contains a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].n...
Fixed in 1.1.5_C1_202607071108
Buffer overflow in D-Link DWR-M961 quicksetup.cgi interface (CVE-2026-71958)
A buffer overflow vulnerability exists in the quicksetup.cgi web-management interface of D-Link DWR-M961 devices (hardware revision C1, firmware 1.1.2_C1_202602110044). A remote attacker can write overly long strings ...
Fixed in 1.1.5_C1_202607071108
Command injection in D-Link DWR-M961 traceroute diagnostic interface (CVE-2026-71947)
A command injection vulnerability exists in the `/boafrm/formTracerouteDiagnosticRun` web-management CGI interface of D-Link DWR-M961 devices (hardware revision C1). A remote attacker can inject arbitrary malicious co...
Fixed in 1.1.5_C1_202607071108