D-Link DWR-M961 CVE-2026-71951

Exploitation requires network access to the router's web management interface and the ability to send a POST request to the /boafrm/formIMEISetup endpoint with a malicious payload in the IMEI_value field; per the CVSS 4.0 vector (PR:N/UI:N) no authentication or user interaction is required. The exploit is limited to D-Link DWR-M961 hardware version C1 running firmware before 1.1.5_C1_202607071108. The key real-world limiting factor is reachability of the management interface: if WAN-side remote administration is disabled (the common default), an attacker must be on the LAN or leverage a misconfigured/exposed device, which meaningfully narrows the practical attack surface below the raw AV:N rating.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 base score of 9.3 reflects the worst-case attack profile: network-reachable (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and full high impact to confidentiality, integrity, and availability of the vulnerable system, yielding root-level command execution. No EPSS score, KEV listing, SSVC decision, or public POC was provided in the input, so real-world exploitation volume cannot be quantified from available data; the flaw carries no public exploit identified at time of analysis and is not confirmed actively exploited. The primary mitigating factor is exposure - SOHO routers are dangerous when the management interface is reachable from the WAN, but many deployments only expose it on the LAN, which limits the practical attack surface to local-network or misconfigured/remote-management scenarios. Given the credibility of the reporter (VulnCheck) and availability of a vendor patch, treat this as high urgency for any internet-exposed devices.

An attacker who can reach the router's web interface (for example, on a device with WAN-side remote management enabled, or from a position on the local network) sends a crafted HTTP POST to /boafrm/formIMEISetup with shell metacharacters embedded in the IMEI_value field. The BOA server passes the value to a shell, executing the attacker's commands as root, allowing full device takeover, traffic interception, or use as a pivot. No public POC was identified in the available data, but the low attack complexity makes weaponization straightforward.