Which versions of D-Link DWR-M961 are affected by EUVD-2026-54797?

A critical unauthenticated remote code execution vulnerability in D-Link DWR-M961 4G LTE routers (revision C1, firmware prior to 1.1.5_C1_202607071108) allows attackers to execute arbitrary commands…. A patch is available.

How to fix or mitigate EUVD-2026-54797?

Within 24 hours, perform a complete asset inventory across all network locations to identify D-Link DWR-M961 revision C1 devices currently deployed, document their current firmware versions, and assess network criticality. Within 7 days, deploy vendor-released firmware version 1.1.5_C1_202607071108 or later to all affected routers using a controlled maintenance window with documented rollback procedures, prioritizing production network devices and those serving critical business functions. Within 30 days, conduct post-patch verification by re-auditing firmware compliance across all devices, implement enhanced logging and monitoring for sign-in attempts and configuration changes, and conduct a network segmentation review to ensure these devices remain appropriately isolated from sensitive systems.

D-Link DWR-M961 EUVD-2026-54797

Q: What is the CVSS score of EUVD-2026-54797?

EUVD-2026-54797 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

| CVE-2026-71945 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-7m6w-qg9f-4rf8

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated OS command injection reachable over the network with no user interaction (AV:N/AC:L/PR:N/UI:N) yields root command execution, giving full C/I/A impact on the device (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:30 vuln.today

CVE Published

Aug 08, 2026 - 16:50 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.

Articles & Coverage 1

News Critical RCE in D-Link DWR-M961 4G LTE Router - CVE-2026-71945 Aug 08, 2026

AnalysisAI

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the fota_url parameter of the /boafrm/formLtefotaUpgradeFibocom endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms it is reachable over the network with no authentication or user interaction, yielding full high-impact compromise (VC:H/VI:H/VA:H). Reported by VulnCheck with a vendor patch now available; no public exploit identified at time of analysis.

Technical ContextAI

The affected device is a consumer/SOHO 4G AC1200 LTE router whose web management interface is built on the BOA web server (evidenced by the /boafrm/ URL prefix common to D-Link firmware). The vulnerable handler, formLtefotaUpgradeFibocom, drives the FOTA (firmware-over-the-air) upgrade workflow for the embedded Fibocom LTE modem, taking a caller-supplied fota_url. Per CWE-78 (Improper Neutralization of Special Elements used in an OS Command), the fota_url value is passed into a shell command - most likely a download utility such as wget/curl invoked via system()/popen - without sanitizing shell metacharacters, so appended operators (e.g. ;, &&, backticks, $()) are executed by the underlying shell. Because BOA and its CGI handlers on these devices run as root, injected commands inherit root privileges. The single CPE, cpe:2.3:a:d-link_corporation:dwr-m961:*:*:*:*:*:*:*:*, scopes the issue to this specific router model.

RemediationAI

Vendor-released patch: upgrade DWR-M961 (H/W C1) to firmware 1.1.5_C1_202607071108 or later, as directed in D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). Until the update is applied, reduce exposure by disabling any remote/WAN-side web management so the administrative interface - and the /boafrm/formLtefotaUpgradeFibocom endpoint - is unreachable from the internet (trade-off: administrators lose remote GUI access and must manage the device from the LAN); restrict access to the management interface to trusted LAN hosts or a management VLAN, and change default administrative credentials to blunt CSRF-style or on-path abuse of the endpoint (trade-off: tighter access control adds operational friction). Because the injection is triggered through the FOTA upgrade flow, avoid initiating firmware-over-the-air upgrades from untrusted networks until patched. After patching, verify the running firmware version in the device UI.