D-Link DWR-M961 CVE-2026-71952

Exploitation requires network reachability to the router's boa-based web management interface and the ability to send a POST to the /boafrm/formPinManageSetup endpoint with a malicious payload in the oldPIn parameter; per CVSS PR:N/UI:N no authentication or user interaction is needed against affected firmware. The concrete limiting factor is exposure of that management interface: if administration is restricted to the LAN and WAN-side management is disabled (a common default), the attacker must first gain a foothold on the local network, which meaningfully narrows the exploitable population despite the network attack vector. Only hardware revision C1 with firmware before 1.1.5_C1_202607071108 is confirmed affected.

This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), and the outcome is root-level command execution. Under an SSVC lens the technical impact is total and the flaw is plausibly automatable given a single-parameter injection with no auth. Tempering factors: no EPSS score was provided, the CVE is NOT in CISA KEV, and no POC is referenced, so there is no evidence of active or widespread exploitation yet - the real-world exposure depends heavily on whether the device's web interface is reachable from the WAN/Internet versus LAN-only. The primary uncertainty is internet-exposure scale of this specific consumer model, not the severity of the bug itself.

An attacker who can reach the router's web interface (for example, a device with WAN-side management enabled or an attacker already on the local network) sends a single crafted HTTP POST to /boafrm/formPinManageSetup with shell metacharacters embedded in the oldPIn field. The injected payload executes as root, letting the attacker install a backdoor, capture traffic, or pivot into the internal network. No authentication, user interaction, or POC tooling is required, though no public exploit is currently identified.