D-Link DWR-M961 CVE-2026-71949

Exploitation requires network reachability to the router's BOA web server and specifically a request to the /boafrm/formUSSDSetup endpoint, injecting shell metacharacters into the ussdValue and/or selectMenuValue parameters; the device must be running hardware version C1 with firmware older than 1.1.5_C1_202607071108. The supplied CVSS 4.0 vector states PR:N/UI:N (no authentication or user interaction), which would mean exploitation against a reachable interface with no further prerequisites. Practical limiting factors: the endpoint is on the administrative web service, so the primary constraint is reachability - devices without WAN-side/remote management exposed are only attackable from the LAN - and if the USSD setup page actually requires an authenticated admin session (common for D-Link /boafrm/ handlers, though contradicted by the PR:N vector), a valid or default admin login would also be needed.

This is a genuine high-priority issue rather than a high-CVSS paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3) describes network-reachable, low-complexity, no-interaction exploitation yielding full compromise, and root-level command execution on a network edge device is maximally impactful. Mitigating the raw score: it is a single consumer/SMB router model with a bounded install base, VulnCheck (not CISA) is the reporter, the CVE is not in CISA KEV, and no EPSS score or public POC was provided, so there is no evidence of active or widespread exploitation yet. One caveat to verify: the supplied vector asserts PR:N (unauthenticated), but many D-Link /boafrm/ handlers sit behind the admin web session - if the USSD setup page in fact requires an authenticated admin session, real-world reachability drops to PR:L, so confirm the authentication requirement against the vendor advisory. Command-injection flaws in D-Link BOA endpoints are historically reliable to weaponize once firmware is analyzed, so treat internet-exposed devices as high risk.

An attacker who can reach the router's web interface (for example an internet-exposed device with remote management enabled) sends a crafted POST to /boafrm/formUSSDSetup with shell metacharacters in the ussdValue or selectMenuValue field, such as a value ending in ';telnetd -l/bin/sh'. The injected command runs as root, letting the attacker plant a backdoor, capture traffic, or enroll the device into a botnet. No public exploit is identified at time of analysis, but the low attack complexity makes weaponization straightforward once firmware is examined.