Which versions of D-Link DWR-M961 are affected by CVE-2026-71947?

D-Link DWR-M961 4G routers in your network present a critical vulnerability-unauthenticated attackers can seize full control without credentials by targeting the diagnostic web interface on any…. A patch is available.

How to fix or mitigate CVE-2026-71947?

Begin by inventorying all D-Link DWR-M961 devices across your enterprise within 24 hours to identify affected firmware versions and network exposure. Proceed to deploy firmware patch version 1.1.5_C1_202607071108 or later within 7 days, validating the update process in a non-production environment before full production rollout. Complete verification of patch coverage by day 30 through automated compliance scanning and update asset management records to reflect the new baseline firmware across all units.

D-Link DWR-M961 CVE-2026-71947

Q: What is the CVSS score of CVE-2026-71947?

CVE-2026-71947 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

EUVD-2026-54799 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-4c4w-2wv9-hj7p

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network request to the diagnostic endpoint executes commands as root with full CIA impact, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged as the OS is the vulnerable component.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:32 vuln.today

CVE Published

Aug 08, 2026 - 16:51 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.

Articles & Coverage 1

News Critical RCE in D-Link DWR-M961 Router (Unauthenticated) - CVE-2026-71947 Aug 09, 2026

AnalysisAI

Remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware version C1, firmware before 1.1.5_C1_202607071108) allows unauthenticated attackers to run arbitrary OS commands as root by injecting into the host and ipVer parameters of the /boafrm/formTracerouteDiagnosticRun web interface. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not in CISA KEV, but a vendor patch has been released and the finding was reported by VulnCheck.

Technical ContextAI

The DWR-M961 is a consumer/SMB 4G LTE router whose administrative web server is the BOA embedded HTTP daemon (the /boafrm/ path prefix is characteristic of BOA-based D-Link firmware). The vulnerable endpoint, formTracerouteDiagnosticRun, implements the router's built-in traceroute diagnostic feature, which shells out to the underlying traceroute utility using attacker-supplied host and ipVer values. This maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the parameters are passed into a system shell without sanitization, so shell metacharacters (e.g. ;, |, &&, backticks) break out of the intended command and execute arbitrary code. Because the BOA server and its CGI handlers run as root on this class of device, injected commands inherit full root privileges.

RemediationAI

Upgrade to the fixed firmware for hardware version C1: Vendor-released patch: firmware 1.1.5_C1_202607071108 or later, per D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). Until the update is applied, disable remote (WAN-side) administration so the management web server is not reachable from the internet, and restrict access to the LAN-side admin interface to trusted hosts only; both measures reduce reachability of the vulnerable /boafrm/formTracerouteDiagnosticRun endpoint but do not remove the flaw for on-LAN attackers. Where the traceroute diagnostic feature is not needed, avoid exposing the diagnostics page, and place the router behind an upstream firewall blocking inbound access to the HTTP management port - noting this breaks any legitimate remote-management workflow that relied on that access.