Which versions of D-Link DWR-M961 are affected by CVE-2026-71954?

A critical vulnerability in the D-Link DWR-M961 4G LTE router (CVSS 9.3) enables remote attackers to execute arbitrary commands with administrative privileges, creating an immediate risk of network…. A patch is available.

How to fix or mitigate CVE-2026-71954?

Within 24 hours, identify and document all D-Link DWR-M961 hardware revision C1 routers in your network infrastructure. Within 7 days, apply firmware version 1.1.5_C1_202607071108 through D-Link SAP10512 patch to all affected devices. Within 30 days, review network access logs and perform a post-patch security audit to confirm no unauthorized access occurred during the vulnerability window.

D-Link DWR-M961 CVE-2026-71954

Q: What is the CVSS score of CVE-2026-71954?

CVE-2026-71954 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

EUVD-2026-54806 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-94gg-9cp2-h5f5

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable low-complexity injection yielding root; PR:L chosen because L2TPv3 config is normally an authenticated admin function despite the vendor's PR:N, and impact is full C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:35 vuln.today

CVE Published

Aug 08, 2026 - 16:54 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.

AnalysisAI

OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary commands as root by injecting shell metacharacters into the tunnelid and sessionid parameters of the /boafrm/formL2tpv3ConfigSetup web interface. The flaw was reported by VulnCheck and a vendor patch is available (D-Link SAP10512); no public exploit identified at time of analysis. The CVSS 4.0 vector rates it 9.3 with full confidentiality, integrity, and availability impact on the router.

Technical ContextAI

The affected component is the router's embedded HTTP server (the BOA-derived 'boafrm' web management stack common to D-Link/Realtek-based CPE), specifically the handler that configures L2TPv3 tunnels. L2TPv3 is a Layer-2 tunneling protocol whose configuration takes numeric identifiers such as a tunnel id and session id. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the handler passes the attacker-supplied tunnelid and sessionid values into an underlying OS shell command (typically via system()/popen() when invoking backend network utilities) without sanitizing shell metacharacters, so appended commands run in the same context as the web server, which on these embedded devices is root. The affected CPE is cpe:2.3:a:d-link_corporation:dwr-m961, a 4G AC1200 LTE router.

RemediationAI

Apply the vendor fix: upgrade to firmware version 1.1.5_C1_202607071108 or later on DWR-M961 hardware revision C1, per D-Link security announcement SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). Until the update is installed, disable remote/WAN-side web management so the /boafrm/ interface is not reachable from the internet (trade-off: administrators lose off-LAN management), restrict access to the LAN admin interface to trusted hosts or a management VLAN, and change default administrator credentials to reduce the chance of authenticated abuse. If L2TPv3 tunneling is not used, avoid configuring it and monitor the device's admin interface for unexpected configuration changes; note these are compensating controls only and do not remove the underlying command-injection flaw.