Which versions of D-Link DWR-M961 are affected by CVE-2026-71950?

The D-Link DWR-M961 4G AC1200 LTE router (firmware versions prior to 1.1.5_C1_202607071108) contains an unauthenticated remote code execution vulnerability that allows attackers to gain full root…. A patch is available.

How to fix or mitigate CVE-2026-71950?

Within 24 hours, inventory all D-Link DWR-M961 devices across your network and document current firmware versions on each unit; immediately restrict network access to the /boafrm/formSmsManage interface if operationally feasible. Within 7 days, deploy firmware version 1.1.5_C1_202607071108 or later to all affected D-Link DWR-M961 devices, prioritizing units in external-facing or high-value network segments and coordinating with branch office and remote site administrators. Within 30 days, verify firmware deployment across 100% of affected inventory via automated scanning, review device access logs for suspicious activity during the exposure window, and implement network segmentation to limit device reachability from untrusted networks.

D-Link DWR-M961 CVE-2026-71950

Q: What is the CVSS score of CVE-2026-71950?

CVE-2026-71950 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

EUVD-2026-54802 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-6hpm-4f52-cv2w

D-Link Command Injection Dwr M961

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection (AV:N/AC:L/PR:N/UI:N) executing as root gives full C:H/I:H/A:H; scope unchanged as impact stays within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:33 vuln.today

CVE Published

Aug 08, 2026 - 16:52 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.

AnalysisAI

Unauthenticated remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) allows attackers to run arbitrary commands as root by injecting into the action_value parameter of the /boafrm/formSmsManage web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the router's boa web server and the ability to send an HTTP request to the /boafrm/formSmsManage interface, with the payload placed in the action_value field; the device must be hardware version C1 running firmware before 1.1.5_C1_202607071108. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue rather than an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: firmware 1.1.5_C1_202607071108 - upgrade all DWR-M961 hardware C1 units to this version or later, obtained via the D-Link advisory at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all D-Link DWR-M961 devices across your network and document current firmware versions on each unit; immediately restrict network access to the /boafrm/formSmsManage interface if operationally feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.