D-Link DWR-M961 CVE-2026-71954

Exploitation requires the ability to send an HTTP POST to the /boafrm/formL2tpv3ConfigSetup endpoint on a DWR-M961 (HW C1) running firmware earlier than 1.1.5_C1_202607071108, with a shell-injection payload placed specifically in the tunnelid or sessionid field. The CVSS vector states PR:N/UI:N (no authentication and no user interaction), but because L2TPv3 configuration is normally an authenticated admin action, defenders should treat 'reachable management interface' as the key prerequisite and verify whether valid admin credentials or an auth bypass are actually needed - the description does not confirm pre-auth reachability. Real-world exploitation is limited by whether the web admin interface is exposed to the attacker's network position: by default consumer routers expose admin on the LAN only, so internet-wide exploitation depends on WAN-side/remote management being enabled.

All signals point to high real-world severity if the management interface is reachable: CVSS 4.0 base 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N and VC:H/VI:H/VA:H, meaning network-reachable, low-complexity, no user interaction, and total compromise of the device as root. The most important caveat is the PR:N (unauthenticated) claim: an L2TPv3 configuration endpoint is normally an authenticated administrative function, so PR:N implies either an authentication bypass or that the endpoint is exposed pre-authentication - this is not confirmed by the description and should be verified with the vendor advisory, as it materially changes exploitability. Tempering the raw score, there is no CISA KEV listing and no public proof-of-concept identified, so this is not confirmed as actively exploited; EPSS was not provided. Practical exposure also depends on whether the WAN-side management interface is enabled, since most consumer routers expose admin only on the LAN by default. Net: a genuinely dangerous root-RCE bug that should be patched promptly, but immediate mass-exploitation risk is moderated by the absence of a public exploit and the likely need for either credentials or WAN-side management exposure.

An attacker who can reach the router's web management interface sends a crafted POST request to /boafrm/formL2tpv3ConfigSetup with a shell metacharacter payload (e.g. a semicolon or backticks) embedded in the tunnelid or sessionid field. The BOA web server passes the value into an OS command unsanitized, and the injected command executes as root, giving the attacker full control of the device to pivot into the internal network, sniff traffic, or install persistent malware. No public proof-of-concept is currently identified, and low attack complexity means a working exploit would be straightforward to develop.