Which versions of D-Link DWR-M961 are affected by CVE-2026-71948?

The D-Link DWR-M961 4G LTE router (revision C1, firmware before 1.1.5_C1_202607071108) contains a critical unauthenticated remote command injection vulnerability (CVE-2026-71948, CVSS 9.3) enabling…. A patch is available.

How to fix or mitigate CVE-2026-71948?

Within 24 hours, identify and audit all D-Link DWR-M961 devices with hardware revision C1 and firmware versions prior to 1.1.5_C1_202607071108 across your network infrastructure. Within 7 days, apply the vendor-released firmware update to version 1.1.5_C1_202607071108 or later to all affected devices, coordinating with network operations to schedule updates during maintenance windows as needed. Within 30 days, verify complete patching of all DWR-M961 deployments and implement network segmentation to restrict administrative access to these devices and prevent them from serving as pivot points for lateral movement.

D-Link DWR-M961 CVE-2026-71948

Q: What is the CVSS score of CVE-2026-71948?

CVE-2026-71948 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

EUVD-2026-54800 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-xx32-ww4m-ppfp

D-Link Command Injection Dwr M961

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network request to an exposed endpoint (AV:N/AC:L/PR:N/UI:N) yields root command execution, giving full C/I/A loss on the device (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:32 vuln.today

CVE Published

Aug 08, 2026 - 16:51 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.

Articles & Coverage 1

News Critical RCE in D-Link DWR-M961 4G LTE Router - CVE-2026-71948 Aug 09, 2026

AnalysisAI

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting into the host field of the /boafrm/formDebugDiagnosticRun diagnostic interface. Reported by VulnCheck and rated CVSS 4.0 9.3 (Critical), it gives full device takeover with no authentication or user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the router's BOA web management interface and the ability to send an HTTP request to the /boafrm/formDebugDiagnosticRun endpoint with a malicious host parameter - no authentication, credentials, or user interaction are needed (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All available signals point to high, immediately actionable risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade DWR-M961 (hardware C1) to firmware 1.1.5_C1_202607071108 or later, as directed in D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and audit all D-Link DWR-M961 devices with hardware revision C1 and firmware versions prior to 1.1.5_C1_202607071108 across your network infrastructure. …

Threat intelligence, references, and detailed analysis are available after sign-in.