Which versions of D-Link DWR-M961 are affected by CVE-2026-71945?

A critical unauthenticated remote code execution vulnerability in D-Link DWR-M961 4G LTE routers (revision C1, firmware prior to 1.1.5_C1_202607071108) allows attackers to execute arbitrary commands…. A patch is available.

How to fix or mitigate CVE-2026-71945?

Within 24 hours, perform a complete asset inventory across all network locations to identify D-Link DWR-M961 revision C1 devices currently deployed, document their current firmware versions, and assess network criticality. Within 7 days, deploy vendor-released firmware version 1.1.5_C1_202607071108 or later to all affected routers using a controlled maintenance window with documented rollback procedures, prioritizing production network devices and those serving critical business functions. Within 30 days, conduct post-patch verification by re-auditing firmware compliance across all devices, implement enhanced logging and monitoring for sign-in attempts and configuration changes, and conduct a network segmentation review to ensure these devices remain appropriately isolated from sensitive systems.

D-Link DWR-M961 CVE-2026-71945

Q: What is the CVSS score of CVE-2026-71945?

CVE-2026-71945 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

EUVD-2026-54797 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-7m6w-qg9f-4rf8

D-Link Command Injection Dwr M961

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated OS command injection reachable over the network with no user interaction (AV:N/AC:L/PR:N/UI:N) yields root command execution, giving full C/I/A impact on the device (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:30 vuln.today

CVE Published

Aug 08, 2026 - 16:50 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.

Articles & Coverage 1

News Critical RCE in D-Link DWR-M961 4G LTE Router - CVE-2026-71945 Aug 08, 2026

AnalysisAI

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the fota_url parameter of the /boafrm/formLtefotaUpgradeFibocom endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms it is reachable over the network with no authentication or user interaction, yielding full high-impact compromise (VC:H/VI:H/VA:H). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The exploitation prerequisite is network reachability of the router's web management interface exposing the /boafrm/formLtefotaUpgradeFibocom handler; the attacker submits a crafted value in the fota_url parameter used by the Fibocom LTE FOTA upgrade routine. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high priority, not an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade DWR-M961 (H/W C1) to firmware 1.1.5_C1_202607071108 or later, as directed in D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, perform a complete asset inventory across all network locations to identify D-Link DWR-M961 revision C1 devices currently deployed, document their current firmware versions, and assess network criticality. …

Threat intelligence, references, and detailed analysis are available after sign-in.