D-Link DWR-M961 CVE-2026-71945

The exploitation prerequisite is network reachability of the router's web management interface exposing the /boafrm/formLtefotaUpgradeFibocom handler; the attacker submits a crafted value in the fota_url parameter used by the Fibocom LTE FOTA upgrade routine. No authentication, no user interaction, and no non-default feature toggle are required per CVSS PR:N/UI:N/AT:N - this is remote unauthenticated exploitation against affected default configurations of the DWR-M961 (H/W C1, firmware before 1.1.5_C1_202607071108). The primary limiting factor is that the vulnerable interface must be reachable from the attacker's position: on many SOHO routers the management UI is LAN-facing by default, so WAN-side exploitation depends on remote management being enabled or the interface otherwise being exposed. Devices already on 1.1.5_C1_202607071108 or later, or other hardware revisions, are outside the confirmed affected set.

This is a genuine high priority, not an inflated CVSS. The CVSS 4.0 base of 9.3 is internally consistent with the description: network-reachable (AV:N), low complexity (AC:L), no attack requirements (AT:N), no privileges (PR:N) and no user interaction (UI:N), producing full confidentiality/integrity/availability loss on the vulnerable system (VC:H/VI:H/VA:H) with no scope change to other systems (SC/SI/SA:N). Root-level command execution on an internet-facing edge device is the highest-value outcome for an attacker. EPSS and SSVC data were not provided, so exploitation probability and automatability cannot be quantified from this input; the vulnerability is not listed in CISA KEV per the data given, and no POC is referenced - so treat exploitation as feasible but not yet confirmed in the wild. The main mitigating factor is exposure: real-world risk hinges on whether the web/FOTA interface is reachable from the WAN, which for many SOHO routers is LAN-only by default but frequently exposed via remote-management or misconfiguration.

An attacker who can reach the router's web interface sends a single crafted HTTP request to /boafrm/formLtefotaUpgradeFibocom with shell metacharacters appended to the fota_url field (e.g. a legitimate-looking URL followed by ;<command>), and the router executes the injected command as root. Given AV:N/AC:L/PR:N/UI:N, no credentials or victim interaction are needed, so this can be automated at scale against exposed devices to drop malware, enroll the router into a botnet, or pivot into the internal network. No public exploit code is identified at time of analysis, though the injection point is precisely described.