Which versions of D-Link DWR-M961 are affected by CVE-2026-71949?

The D-Link DWR-M961 4G LTE router (hardware revision C1) contains a critical remote command execution vulnerability that enables attackers to gain complete control of affected devices as root.. A patch is available.

How to fix or mitigate CVE-2026-71949?

Within 24 hours: inventory all D-Link DWR-M961 revision C1 units currently in production and cross-reference against the affected firmware versions (pre-1.1.5_C1_202607071108); escalate any internet-facing instances as critical. Within 7 days: obtain the vendor patch (firmware 1.1.5_C1_202607071108 or later), validate in a test environment, and schedule deployment windows for non-critical infrastructure to establish patch readiness. Within 30 days: deploy the firmware patch to all production devices on a maintenance schedule designed to minimize service impact and complete remediation.

D-Link DWR-M961 CVE-2026-71949

Q: What is the CVSS score of CVE-2026-71949?

CVE-2026-71949 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

EUVD-2026-54801 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-p269-h6xm-xcqv

D-Link Command Injection Dwr M961

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable web endpoint, low complexity, no interaction, and root-level command execution give full C/I/A; PR:N follows the supplied vector though an admin session may in practice raise it to PR:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:32 vuln.today

CVE Published

Aug 08, 2026 - 16:52 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.

Articles & Coverage 1

News Critical OS Command Injection in D-Link DWR-M961 4G LTE Router - CVE-2026-71949 Aug 09, 2026

AnalysisAI

OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets a remote attacker execute arbitrary commands as root through the /boafrm/formUSSDSetup web interface. Unsanitized input in the ussdValue and selectMenuValue parameters is passed to a shell, giving full device takeover with high confidentiality, integrity, and availability impact (CVSS 4.0 9.3). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the router's BOA web server and specifically a request to the /boafrm/formUSSDSetup endpoint, injecting shell metacharacters into the ussdValue and/or selectMenuValue parameters; the device must be running hardware version C1 with firmware older than 1.1.5_C1_202607071108. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue rather than a high-CVSS paper risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade DWR-M961 (hardware C1) to firmware 1.1.5_C1_202607071108 or later, per D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: inventory all D-Link DWR-M961 revision C1 units currently in production and cross-reference against the affected firmware versions (pre-1.1.5_C1_202607071108); escalate any internet-facing instances as critical. …

Threat intelligence, references, and detailed analysis are available after sign-in.