Which versions of D-Link DWR-M961 are affected by CVE-2026-71951?

The D-Link DWR-M961 4G LTE router (hardware revision C1, firmware pre-1.1.5) contains a critical unauthenticated remote command injection vulnerability (CVE-2026-71951, CVSS 9.3) allowing attackers…. A patch is available.

How to fix or mitigate CVE-2026-71951?

Within 24 hours, inventory all D-Link DWR-M961 routers (revision C1 only) and identify firmware versions; isolate or network-segment any internet-facing instances to restrict external access. Within 7 days, deploy firmware version 1.1.5_C1_202607071108 or later to all affected devices in prioritized batches (critical infrastructure first), validating functionality after each deployment. Within 30 days, complete patch deployment to all devices, conduct log analysis for exploitation attempts prior to patching, and document the patching timeline and coverage for compliance records.

D-Link DWR-M961 CVE-2026-71951

Q: What is the CVSS score of CVE-2026-71951?

CVE-2026-71951 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

EUVD-2026-54803 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-fx5p-gh5f-884v

D-Link Command Injection Dwr M961

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable web endpoint (AV:N/AC:L/PR:N/UI:N) yields root command execution, giving full C/I/A impact on the device with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:33 vuln.today

CVE Published

Aug 08, 2026 - 16:53 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.

AnalysisAI

Command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary OS commands as root by injecting into the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high confidentiality, integrity, and availability impact, and a vendor patch is available. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network access to the router's web management interface and the ability to send a POST request to the /boafrm/formIMEISetup endpoint with a malicious payload in the IMEI_value field; per the CVSS 4.0 vector (PR:N/UI:N) no authentication or user interaction is required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade the DWR-M961 (hardware version C1) to firmware 1.1.5_C1_202607071108 or later, as directed in the D-Link advisory at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all D-Link DWR-M961 routers (revision C1 only) and identify firmware versions; isolate or network-segment any internet-facing instances to restrict external access. …

Threat intelligence, references, and detailed analysis are available after sign-in.