Which versions of D-Link DWR-M961 are affected by CVE-2026-71958?

A critical remote code execution vulnerability in D-Link's DWR-M961 4G LTE router allows unauthenticated network-based attackers to execute arbitrary commands on affected devices, directly…. A patch is available.

How to fix or mitigate CVE-2026-71958?

Within 24 hours: Identify all D-Link DWR-M961 routers (hardware revision C1, firmware 1.1.2_C1_202602110044) currently deployed across the organization and confirm their current firmware versions. Within 7 days: Apply the vendor-released patch to all affected devices, prioritizing production network segments, and verify successful firmware updates are installed and confirmed functional. Within 30 days: Review network access logs for any suspicious or unauthorized access attempts to router management interfaces during the vulnerability window, implement network-layer access controls to restrict administrative access to these devices from untrusted networks, and establish automated firmware update processes for all network appliances to prevent similar exposure windows.

D-Link DWR-M961 CVE-2026-71958

Q: What is the CVSS score of CVE-2026-71958?

CVE-2026-71958 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-54810 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-08-08 VulnCheck

GHSA-8mjf-qrcg-h2cj

D-Link Buffer Overflow Dwr M961

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable CGI overflow (AV:N/AC:L/PR:N/UI:N) yielding command execution as root with device crash gives full C/I/A; scope unchanged as impact stays within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:50 vuln.today

CVE Published

Aug 08, 2026 - 17:07 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

AnalysisAI

Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow stack/heap buffers in the quicksetup.cgi handler by submitting oversized test4, ssid2, and username field values, gaining arbitrary command execution or crashing the device. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to reach the quicksetup.cgi endpoint of the DWR-M961 web administration interface and submit over-length input in the test4, ssid2, or username POST fields - these three fields and this CGI are the exact, named prerequisites. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are largely consistent and point to a genuine high priority for exposed devices: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) describes trivial remote exploitation with no authentication, no user interaction, and full impact - the maximum realistic exposure profile for a network service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the vendor fix: a patch is available per D-Link security advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512) - consult that advisory for the exact patched firmware build for hardware C1, as a specific fixed version string was not included in the source data (Patch status: Patch available per vendor advisory; released patched version not independently confirmed here). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all D-Link DWR-M961 routers (hardware revision C1, firmware 1.1.2_C1_202602110044) currently deployed across the organization and confirm their current firmware versions. …

Threat intelligence, references, and detailed analysis are available after sign-in.