D-Link DWR-M961 CVE-2026-71958

Exploitation requires the attacker to reach the quicksetup.cgi endpoint of the DWR-M961 web administration interface and submit over-length input in the test4, ssid2, or username POST fields - these three fields and this CGI are the exact, named prerequisites. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or user interaction is required and no special non-default configuration is called out, so against a reachable device exploitation is unauthenticated and single-shot. The practical limiting factor is network reachability of the admin interface: on SOHO routers the web UI is normally LAN-only unless remote/WAN management is enabled, which constrains internet-wide exploitation. Only hardware revision C1 with firmware 1.1.2_C1_202602110044 is confirmed affected, limiting scope to that build.

The signals are largely consistent and point to a genuine high priority for exposed devices: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) describes trivial remote exploitation with no authentication, no user interaction, and full impact - the maximum realistic exposure profile for a network service. No EPSS score was supplied, and the CVE is not in CISA KEV, so there is no evidence of active mass exploitation to date; no public POC was provided either. The main real-world limiter is exposure: SOHO router web interfaces are usually LAN-facing by default, so risk is highest where remote management is enabled or the device is directly internet-exposed. Note one caveat: the description states the attacker must 'write' to CGI fields and 'craft a specific payload,' which normally implies reaching the admin CGI - verify whether authentication or WAN-side access to quicksetup.cgi is actually required on default configurations, since the PR:N metric assumes it is reachable pre-auth.

An attacker who can reach the router's web interface - for example a device with remote management enabled or otherwise internet-exposed - sends a crafted HTTP request to quicksetup.cgi containing an over-length string in the test4, ssid2, or username field. The oversized value overflows a fixed-size buffer, overwriting control data so the attacker either executes arbitrary commands as the web server user (typically root) or crashes the device into a denial-of-service reboot loop. No authentication or user interaction is indicated by the CVSS vector, and no public POC was provided in the source data.