D-Link DWR-M961 CVE-2026-71948

Exploitation requires network reachability to the router's BOA web management interface and the ability to send an HTTP request to the /boafrm/formDebugDiagnosticRun endpoint with a malicious host parameter - no authentication, credentials, or user interaction are needed (PR:N/UI:N). The vulnerability is limited to DWR-M961 hardware revision C1 on firmware earlier than 1.1.5_C1_202607071108; other hardware/firmware combinations are not confirmed affected. The most significant real-world limiter is interface exposure: exploitation is trivial if the admin interface is WAN-facing, but constrained to local/adjacent attackers if administration is restricted to the LAN.

All available signals point to high, immediately actionable risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated attack yielding complete confidentiality, integrity, and availability loss - i.e., root RCE. There is no EPSS score, KEV entry, or SSVC decision data in the provided input, so probabilistic exploitation likelihood cannot be quantified; however, command-injection flaws in exposed router web interfaces are historically favored by botnets (e.g., Mirai-class) once details are public. The primary mitigating factor is exposure scope: risk is severe if the web interface is reachable from the WAN/Internet, and substantially lower if administration is confined to the LAN. No public exploit is identified at time of analysis, so current risk is driven by the vulnerability's inherent trivial exploitability rather than confirmed in-the-wild activity.

An attacker who can reach the router's web interface sends a single crafted HTTP request to /boafrm/formDebugDiagnosticRun with shell metacharacters appended to the host field (e.g., a value that chains an additional command). The BOA server passes the value to a shell running as root, executing the attacker's commands and yielding full device compromise - enabling traffic interception, persistent backdoors, or enrollment into a botnet. No authentication or user interaction is required; no public POC is identified at time of analysis, but the injection is trivial to weaponize.