Which versions of D-Link DWR-M961 are affected by CVE-2026-71956?

The D-Link DWR-M961 4G LTE router (firmware 1.1.2_C1_202602110044) contains a critical remote vulnerability (CVE-2026-71956) enabling complete device compromise and unauthorized network access.. A patch is available.

How to fix or mitigate CVE-2026-71956?

Within 24 hours, identify all D-Link DWR-M961 routers (hardware C1) running firmware 1.1.2_C1_202602110044 in your environment and isolate them from critical systems if immediate patching is not feasible. Within 7 days, deploy vendor patch SAP10512 to all affected devices and verify deployment completion. Within 30 days, review access logs on patched devices for suspicious activity during the vulnerability window and confirm complete remediation across the inventory.

D-Link DWR-M961 CVE-2026-71956

Q: What is the CVSS score of CVE-2026-71956?

CVE-2026-71956 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.7%.

EUVD-2026-54808 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-67wv-98r5-fch9

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, low-complexity command injection with no interaction yields root, so C/I/A:H; PR:N follows the provided vector but is uncertain since the diagnostic endpoint may require web-UI authentication.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:50 vuln.today

CVE Published

Aug 08, 2026 - 17:05 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.

AnalysisAI

OS command injection in the D-Link DWR-M961 4G LTE router (hardware C1, firmware 1.1.2_C1_202602110044) lets a remote attacker inject arbitrary shell commands through the netDig.ping.dst parameter of the app.cgi diagnostic interface, yielding command execution as root. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; a vendor patch is available (SAP10512), and no public exploit has been identified at time of analysis.

Technical ContextAI

The affected component is app.cgi, the CGI handler backing the router's web administration and network-diagnostic features. The netDig.ping.dst field supplies the destination host for a built-in ping/network-dig diagnostic, and the value is passed to an underlying OS shell (e.g., via system()/popen()) without adequate sanitization - the classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) root cause. Because embedded CGI processes on SOHO routers typically run as root, injected shell metacharacters (;, |, `, $()) execute with full privileges. The single CPE cpe:2.3:a:d-link_corporation:dwr-m961 confirms the DWR-M961 platform as the affected product; the flaw is tied to the specific C1 hardware revision and the 1.1.2_C1_202602110044 firmware build.

RemediationAI

Apply the vendor-provided fix per D-Link security advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512); patch available per vendor advisory, though an exact fixed firmware version string was not included in the available data, so obtain the corrected build directly from that advisory and confirm the version after upgrade. Until the update is installed, restrict access to the router's web management/app.cgi interface: disable remote (WAN-side) administration so the diagnostic endpoint is not internet-reachable, and limit LAN access to trusted management hosts (trade-off: legitimate remote management is lost, and LAN-side attackers or malware are still in scope). Where feasible, place the router's management plane behind a VPN or ACL and change default administrative credentials to reduce the chance the diagnostic page is reachable by an attacker.