D-Link DWR-M961 CVE-2026-71950

Exploitation requires network reachability to the router's boa web server and the ability to send an HTTP request to the /boafrm/formSmsManage interface, with the payload placed in the action_value field; the device must be hardware version C1 running firmware before 1.1.5_C1_202607071108. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special configuration, and no user interaction are needed against affected default configurations. The primary limiting factor is exposure of the management interface: if the HTTP admin interface is only reachable from the LAN (typical default), the attacker must be on the local network or traverse another exposure path, whereas any WAN-side management exposure permits direct unauthenticated internet exploitation.

This is a genuine high-priority issue rather than an inflated CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact - the worst realistic profile for a network device. Root-level command injection on an edge router means complete takeover, traffic interception, and pivoting into the internal network. No EPSS score, KEV listing, or SSVC decision data was provided, so probabilistic exploitation likelihood and confirmed active-exploitation status are unknown; however, the combination of unauthenticated RCE and VulnCheck disclosure makes this an attractive target class historically favored by botnet operators. The main mitigating factor is exposure: risk is severe only where the web interface is reachable by the attacker, which for a home/SOHO LTE router is often the LAN side or a WAN-exposed management page.

An attacker who can reach the router's web interface - either on the local network or via an internet-exposed management port - sends a single crafted HTTP request to /boafrm/formSmsManage with shell metacharacters embedded in the action_value field. The injected commands execute as root, letting the attacker install a backdoor, alter DNS or firewall rules, and intercept all traffic traversing the router. No authentication or user interaction is required, so the attack can be fully automated across reachable devices; no public exploit is identified at time of analysis.