D-Link DWR-M961 CVE-2026-71957

Exploitation requires network reachability to the DWR-M961 web management interface (the app.cgi endpoint) and the ability to submit the netAcc.addlist[].name parameter with an over-length, crafted string; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. The concrete prerequisite is that the vulnerable app.cgi handler is accessible to the attacker - trivially met from the LAN, and met from the internet only where WAN-side/remote management is enabled or the port is exposed via forwarding. Limiting factors: only hardware version C1 on firmware 1.1.2_C1_202602110044 is confirmed affected, and realistic remote (internet) exploitation depends on the management interface not being LAN-restricted in the deployment.

The signals are strongly and consistently aligned toward high real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated, no-interaction exploitation with high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H), yielding a 9.3 Critical score. It is a memory-corruption bug in an internet-facing CGI on a router - a category historically favored for botnet recruitment and mass scanning. Not in CISA KEV, so it is not confirmed as actively exploited, and no POC has surfaced yet, which tempers immediacy; EPSS was not provided so probability of near-term exploitation cannot be quantified from the input. The key caveat is exposure: if the app.cgi/web management interface is only bound to the LAN in default configurations, the practical AV:N reachability depends on WAN-side management being enabled or the attacker already being on the local network - verify management-interface exposure with the vendor. Even so, this is a genuine priority given the unauthenticated RCE potential and the low bar for weaponization once a payload is public.

An attacker who can reach the router's web management interface (over the WAN if remote administration is enabled, or from the local network) sends a crafted HTTP request to app.cgi with an overly long, specially structured netAcc.addlist[].name value. The overflow overwrites control data in the CGI process, letting the attacker execute arbitrary commands on the router (likely as root) or crash the device; with low attack complexity and no authentication required, exploitation is straightforward once a working payload is developed. No public exploit code has been identified at time of analysis.