D-Link DWR-M961 CVE-2026-71953

Exploitation requires HTTP access to the router's web management interface and the ability to POST to the /boafrm/formNtp handler with a malicious ntpServerIp1 value; per the CVSS 4.0 vector (PR:N/UI:N) no authentication or user interaction is needed against the affected firmware. The primary limiting factor is network reachability of the management interface: the attack is trivial from the LAN and internet-wide only where WAN-side management is enabled or the device is otherwise internet-exposed. The vulnerability is scoped to DWR-M961 hardware version C1 with firmware earlier than 1.1.5_C1_202607071108, so patched units and other hardware revisions are outside the confirmed condition set.

This is a genuine high-priority issue rather than an inflated score. The CVSS 4.0 base of 9.3 is internally consistent with the description: the NTP configuration endpoint is network-reachable (AV:N), exploitation is low-complexity with no special attack requirements (AC:L/AT:N), and it needs no privileges or user interaction (PR:N/UI:N), all of which match a classic unauthenticated command-injection primitive resulting in root code execution (VC:H/VI:H/VA:H). No EPSS score, SSVC decision, or POC was provided, so exploitation probability cannot be quantified from the input, and the vulnerability is not in CISA KEV, so active exploitation is not confirmed. The main real-world caveat is exposure: risk is critical for any unit whose management interface is reachable from the WAN or an untrusted LAN, but command-injection bugs in this endpoint class are frequently reproduced quickly, so treat the low-effort/high-impact profile as a strong patch driver even absent an EPSS or KEV signal.

An attacker who can reach the router's web management interface sends a crafted HTTP POST to /boafrm/formNtp with shell metacharacters appended to the ntpServerIp1 field (e.g., a legitimate-looking IP followed by ; or a backtick-wrapped command). The BOA server passes the value to a shell as root, running the injected command and giving the attacker full device control such as opening a reverse shell or altering DNS/routing. No public POC is referenced in the available data, but the low attack complexity makes reliable exploitation straightforward for an attacker with interface access.