Which versions of D-Link DWR-M961 are affected by CVE-2026-71946?

D-Link DWR-M961 4G LTE routers (hardware revision C1) running firmware before version 1.1.5_C1_202607071108 are vulnerable to unauthenticated remote command injection that enables attackers to…. A patch is available.

How to fix or mitigate CVE-2026-71946?

Within 24 hours: Identify and inventory all D-Link DWR-M961 routers (hardware revision C1) in use; immediately segregate units with internet exposure and move offline if patching cannot complete within 48 hours. Within 7 days: Apply vendor-released firmware patch version 1.1.5_C1_202607071108 or later to all affected devices and confirm successful deployment and activation across the entire fleet. Within 30 days: Conduct forensic analysis of router access and syslog data covering the vulnerability disclosure period to identify any unauthorized command execution; implement network segmentation restricting web management interface access to authorized administrative subnets only; and establish automated firmware update processes to prevent future patch deployment delays.

D-Link DWR-M961 CVE-2026-71946

Q: What is the CVSS score of CVE-2026-71946?

CVE-2026-71946 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

EUVD-2026-54798 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-5x6m-6m29-96rg

D-Link Command Injection Dwr M961

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network request to the ping endpoint runs commands as root with full C/I/A loss; scope unchanged as code executes within the device's own context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:30 vuln.today

CVE Published

Aug 08, 2026 - 16:50 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.

Articles & Coverage 1

News Critical RCE in D-Link DWR-M961 4G LTE Router - CVE-2026-71946 Aug 08, 2026

AnalysisAI

Remote command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) lets unauthenticated attackers run arbitrary OS commands as root by abusing the host parameter of the /boafrm/formPingDiagnosticRun ping-diagnostic endpoint. The CVSS 4.0 base score is 9.3 (critical) with a fully remote, no-privilege, no-interaction vector, giving complete device takeover. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the router's boa web management interface and specifically the /boafrm/formPingDiagnosticRun ping-diagnostic endpoint; the attacker supplies a malicious payload in the host field of that request. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All signals point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade the DWR-M961 C1 to firmware 1.1.5_C1_202607071108 or later, as directed in D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify and inventory all D-Link DWR-M961 routers (hardware revision C1) in use; immediately segregate units with internet exposure and move offline if patching cannot complete within 48 hours. …

Threat intelligence, references, and detailed analysis are available after sign-in.