Which versions of D-Link DWR-M961 are affected by EUVD-2026-54800?

The D-Link DWR-M961 4G LTE router (revision C1, firmware before 1.1.5_C1_202607071108) contains a critical unauthenticated remote command injection vulnerability (CVE-2026-71948, CVSS 9.3) enabling…. A patch is available.

How to fix or mitigate EUVD-2026-54800?

Within 24 hours, identify and audit all D-Link DWR-M961 devices with hardware revision C1 and firmware versions prior to 1.1.5_C1_202607071108 across your network infrastructure. Within 7 days, apply the vendor-released firmware update to version 1.1.5_C1_202607071108 or later to all affected devices, coordinating with network operations to schedule updates during maintenance windows as needed. Within 30 days, verify complete patching of all DWR-M961 deployments and implement network segmentation to restrict administrative access to these devices and prevent them from serving as pivot points for lateral movement.

D-Link DWR-M961 EUVD-2026-54800

Q: What is the CVSS score of EUVD-2026-54800?

EUVD-2026-54800 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

| CVE-2026-71948 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-xx32-ww4m-ppfp

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network request to an exposed endpoint (AV:N/AC:L/PR:N/UI:N) yields root command execution, giving full C/I/A loss on the device (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:32 vuln.today

CVE Published

Aug 08, 2026 - 16:51 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.

Articles & Coverage 1

News Critical RCE in D-Link DWR-M961 4G LTE Router - CVE-2026-71948 Aug 09, 2026

AnalysisAI

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting into the host field of the /boafrm/formDebugDiagnosticRun diagnostic interface. Reported by VulnCheck and rated CVSS 4.0 9.3 (Critical), it gives full device takeover with no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not currently listed in CISA KEV.

Technical ContextAI

The DWR-M961 is a D-Link 4G/LTE AC1200 SOHO router running the BOA embedded web server, whose form handlers are exposed under the /boafrm/ URI namespace. The vulnerable endpoint, formDebugDiagnosticRun, is a network diagnostic feature (ping/traceroute-style) that passes the user-supplied host parameter into an underlying shell command without adequate sanitization. This is a classic CWE-78 (OS Command Injection): shell metacharacters in the host field break out of the intended command context, and because BOA and its CGI handlers on these devices typically run as root, injected commands inherit full root privileges.

RemediationAI

Vendor-released patch: upgrade DWR-M961 (hardware C1) to firmware 1.1.5_C1_202607071108 or later, as directed in D-Link advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). Until the update is applied, disable remote/WAN administration so the web management interface is not reachable from the Internet (trade-off: loss of remote management convenience), and restrict access to the management interface to trusted LAN hosts or a management VLAN. Where feasible, block inbound access to the HTTP/HTTPS admin ports at the network edge and avoid exposing the /boafrm/ diagnostic endpoints externally (trade-off: none for typical home/SOHO use, since diagnostics are rarely needed from the WAN). Verify the running firmware build string after updating to confirm the fixed version is active.