D-Link DWR-M961 CVE-2026-71946

Exploitation requires network reachability to the router's boa web management interface and specifically the /boafrm/formPingDiagnosticRun ping-diagnostic endpoint; the attacker supplies a malicious payload in the host field of that request. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required. The practical limiting factor is exposure of the management interface: full internet-wide unauthenticated exploitation requires WAN-side administration to be enabled or the device otherwise internet-exposed, otherwise the attacker must be on the LAN or on-path. Only hardware version C1 with firmware before 1.1.5_C1_202607071108 is affected.

All signals point to genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with total loss of confidentiality, integrity, and availability - corroborated by the description's 'remote attacker' and 'root privileges' language, so the vector and prose are consistent rather than conflicting. The main risk-limiting factor is exposure: routers only face internet-wide attack when their management interface is reachable from the WAN, otherwise exploitation is constrained to the LAN or an on-path attacker. No EPSS score was provided, so exploitation-probability modeling is unavailable; no SSVC decision data was supplied; and there is no public exploit identified at time of analysis and no CISA KEV listing, meaning active exploitation is not confirmed. Net assessment: a low-complexity, unauthenticated root RCE in a network appliance should be treated as high priority despite the absence of a confirmed public PoC.

An attacker who can reach the router's web interface - for example a device with WAN-side management exposed to the internet, or a malicious client on the LAN - sends a single crafted HTTP request to /boafrm/formPingDiagnosticRun with shell metacharacters appended to the host field (e.g., a ping target followed by ';' and a payload). The injected commands execute as root, allowing the attacker to install a backdoor, capture traffic, or pivot into the internal network. No public PoC has been identified at time of analysis, but the low complexity makes weaponization straightforward.