Which versions of D-Link DWR-M961 are affected by EUVD-2026-54798?

D-Link DWR-M961 4G LTE routers (hardware revision C1) running firmware before version 1.1.5_C1_202607071108 are vulnerable to unauthenticated remote command injection that enables attackers to…. A patch is available.

How to fix or mitigate EUVD-2026-54798?

Within 24 hours: Identify and inventory all D-Link DWR-M961 routers (hardware revision C1) in use; immediately segregate units with internet exposure and move offline if patching cannot complete within 48 hours. Within 7 days: Apply vendor-released firmware patch version 1.1.5_C1_202607071108 or later to all affected devices and confirm successful deployment and activation across the entire fleet. Within 30 days: Conduct forensic analysis of router access and syslog data covering the vulnerability disclosure period to identify any unauthorized command execution; implement network segmentation restricting web management interface access to authorized administrative subnets only; and establish automated firmware update processes to prevent future patch deployment delays.

D-Link DWR-M961 EUVD-2026-54798

Q: What is the CVSS score of EUVD-2026-54798?

EUVD-2026-54798 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

| CVE-2026-71946 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-5x6m-6m29-96rg

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network request to the ping endpoint runs commands as root with full C/I/A loss; scope unchanged as code executes within the device's own context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:30 vuln.today

CVE Published

Aug 08, 2026 - 16:50 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.

Articles & Coverage 1

News Critical RCE in D-Link DWR-M961 4G LTE Router - CVE-2026-71946 Aug 08, 2026

AnalysisAI

Remote command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) lets unauthenticated attackers run arbitrary OS commands as root by abusing the host parameter of the /boafrm/formPingDiagnosticRun ping-diagnostic endpoint. The CVSS 4.0 base score is 9.3 (critical) with a fully remote, no-privilege, no-interaction vector, giving complete device takeover. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the trivially exploitable vector and VulnCheck reporting make this a high-priority patch.

Technical ContextAI

The DWR-M961 is a consumer/SOHO 4G AC1200 LTE router whose web management interface is served by the embedded boa HTTP daemon, evident from the /boafrm/ URI namespace. The flaw is a classic CWE-78 OS command injection: the formPingDiagnosticRun handler implements the router's network ping diagnostic feature and passes the user-supplied host field into a shell command (e.g., a system()/popen() call invoking ping) without sanitization, so shell metacharacters injected into that field are interpreted by the underlying shell. Because boa and its CGI handlers on this class of device run as root, injected commands execute with root privileges. The affected product is identified by CPE cpe:2.3:a:d-link_corporation:dwr-m961, limited to hardware version C1.

RemediationAI

Vendor-released patch: upgrade the DWR-M961 C1 to firmware 1.1.5_C1_202607071108 or later, as directed in D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). Until the update is applied, disable remote/WAN administration so the web interface is not reachable from the internet (trade-off: loses remote management convenience), and restrict access to the LAN-side management interface to trusted hosts or a management VLAN; if the ping-diagnostic feature is not needed, avoid using it and keep the admin interface off untrusted networks. Because the injection is unauthenticated, changing the admin password alone is not a sufficient mitigation - network-level access restriction is the meaningful compensating control until firmware is updated.