How to fix or mitigate CVE-2026-71952?

Within 24 hours, inventory all D-Link DWR-M961 devices organization-wide, documenting hardware revision C1 and current firmware versions, with particular attention to internet-facing instances. Within 7 days, deploy firmware version 1.1.5_C1_202607071108 or later to all affected devices in a staged rollout, beginning with perimeter and critical network devices. Within 30 days, complete patch verification across the entire fleet, review network access logs for suspicious activity or compromise indicators from the vulnerability exposure period, and implement enhanced monitoring on these router devices.

D-Link DWR-M961 CVE-2026-71952

Q: What is the CVSS score of CVE-2026-71952?

CVE-2026-71952 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

Q: Which versions of D-Link DWR-M961 are affected by CVE-2026-71952?

A critical unauthenticated vulnerability in D-Link DWR-M961 4G LTE routers (hardware revision C1, firmware before 1.1.5_C1_202607071108) enables remote attackers to gain root-level access and fully…. A patch is available.

EUVD-2026-54804 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-vgrr-42ff-cr47

D-Link Command Injection Dwr M961

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated, low-complexity network POST to a web endpoint (AV:N/AC:L/PR:N/UI:N) yields root command execution with full C/I/A impact on the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:34 vuln.today

CVE Published

Aug 08, 2026 - 16:53 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges.

AnalysisAI

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the oldPIn parameter of the /boafrm/formPinManageSetup web endpoint. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device takeover. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the router's boa-based web management interface and the ability to send a POST to the /boafrm/formPinManageSetup endpoint with a malicious payload in the oldPIn parameter; per CVSS PR:N/UI:N no authentication or user interaction is needed against affected firmware. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), and the outcome is root-level command execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to firmware 1.1.5_C1_202607071108 or later for hardware revision C1, as directed in D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all D-Link DWR-M961 devices organization-wide, documenting hardware revision C1 and current firmware versions, with particular attention to internet-facing instances. …

Threat intelligence, references, and detailed analysis are available after sign-in.