How to fix or mitigate CVE-2026-71944?

Within 24 hours, identify and inventory all D-Link DWR-M961 hardware revision C1 routers currently deployed and evaluate their operational criticality. Within 7 days, deploy firmware version 1.1.5_C1_202607071108 or later to all affected devices, prioritizing production network segments and business-critical paths. Within 30 days, complete patch deployment verification, review access logs from the pre-patch period for exploitation attempts, and document patch compliance for audit records.

D-Link DWR-M961 CVE-2026-71944

Q: What is the CVSS score of CVE-2026-71944?

CVE-2026-71944 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

Q: Which versions of D-Link DWR-M961 are affected by CVE-2026-71944?

A critical remote-access vulnerability in D-Link DWR-M961 4G LTE routers (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows unauthenticated attackers to execute arbitrary OS…. A patch is available.

EUVD-2026-54796 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-57vx-fmg4-8ccc

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated request injects commands run as root with no user interaction, so AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged as impact stays on the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:30 vuln.today

CVE Published

Aug 08, 2026 - 16:49 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.

Articles & Coverage 1

News Critical RCE in D-Link DWR-M961 4G LTE Router via Command Injection - CVE-2026-71944 Aug 08, 2026

AnalysisAI

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting shell metacharacters into the fota_url parameter of the /boafrm/formLtefotaUpgradeQuectel web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw yields full device takeover with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability makes it a strong candidate for weaponization.

Technical ContextAI

The DWR-M961 runs a BOA-based embedded web server whose CGI-style handlers are exposed under /boafrm/. The vulnerable endpoint, formLtefotaUpgradeQuectel, drives the LTE FOTA (firmware-over-the-air) upgrade routine for the Quectel cellular module. The fota_url field is intended to carry the URL of a firmware image but is passed into a system shell invocation (likely via system()/popen() or a wget/curl call) without sanitization, so shell metacharacters (;, |, `, $()) break out of the intended command. This is a textbook CWE-78 OS Command Injection: attacker-controlled input concatenated into a command string executed by the router's root-owned web daemon. The affected product is identified by CPE cpe:2.3:a:d-link_corporation:dwr-m961:*:*:*:*:*:*:*:*, scoped to hardware version C1.

RemediationAI

Vendor-released patch: upgrade DWR-M961 (hardware C1) to firmware 1.1.5_C1_202607071108 or later per D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). Until the update is applied, disable remote/WAN-side management so the web interface is not reachable from the internet, and restrict LAN access to the management UI to trusted administrative hosts (for example via client isolation or an ACL) - the trade-off is reduced convenience for legitimate remote administration. Because the injection point is the FOTA upgrade handler, avoid triggering LTE firmware upgrades until patched, and monitor the device for unexpected outbound connections or configuration changes that would indicate compromise. Placing the router behind an upstream firewall that blocks unsolicited inbound access to its HTTP management port is an effective compensating control where feasible.