D-Link DWR-M961 CVE-2026-71947

Exploitation requires network access to the router's BOA web management interface and the ability to reach the /boafrm/formTracerouteDiagnosticRun endpoint; the malicious payload must be placed in the host or ipVer parameters, which feed the traceroute diagnostic command. Per the CVSS vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special non-default configuration are required beyond the management interface being reachable by the attacker. The practical limiting factor is exposure of that web interface: internet-wide unauthenticated exploitation is possible only where remote/WAN administration is enabled or the port is otherwise exposed; otherwise an attacker must be on the LAN. Only hardware version C1 with firmware before 1.1.5_C1_202607071108 is confirmed affected.

All available signals point to genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes the worst-case network-facing case: no authentication, no user interaction, low complexity, and complete impact - consistent with the root-level command injection in the description. EPSS was not supplied and cannot be quoted. The CVE is NOT listed in CISA KEV and no POC has been published, so this is not confirmed active exploitation; however, command-injection flaws in D-Link BOA endpoints are historically fast-to-weaponize and heavily targeted by IoT botnets, so the practical risk of exploitation once details spread is high. The main real-world limiter is exposure: full unauthenticated impact assumes the web management interface is reachable by the attacker (WAN-exposed or same LAN). No conflicting signals were found between the vector and the description - both indicate remote, unauthenticated, root-level impact.

An attacker who can reach the router's web management interface sends a single crafted HTTP request to /boafrm/formTracerouteDiagnosticRun with shell metacharacters embedded in the host or ipVer field (e.g. a value like ;telnetd -l/bin/sh -p9999;). The BOA CGI handler passes this to a shell during the traceroute operation, executing the injected command as root and giving the attacker a foothold for device takeover, botnet enrollment, or pivoting into the internal network. No public exploit is identified yet, but the low attack complexity and lack of authentication make reliable exploitation straightforward once the endpoint is reachable.