Which versions of D-Link DWR-M961 are affected by EUVD-2026-54802?

The D-Link DWR-M961 4G AC1200 LTE router (firmware versions prior to 1.1.5_C1_202607071108) contains an unauthenticated remote code execution vulnerability that allows attackers to gain full root…. A patch is available.

How to fix or mitigate EUVD-2026-54802?

Within 24 hours, inventory all D-Link DWR-M961 devices across your network and document current firmware versions on each unit; immediately restrict network access to the /boafrm/formSmsManage interface if operationally feasible. Within 7 days, deploy firmware version 1.1.5_C1_202607071108 or later to all affected D-Link DWR-M961 devices, prioritizing units in external-facing or high-value network segments and coordinating with branch office and remote site administrators. Within 30 days, verify firmware deployment across 100% of affected inventory via automated scanning, review device access logs for suspicious activity during the exposure window, and implement network segmentation to limit device reachability from untrusted networks.

D-Link DWR-M961 EUVD-2026-54802

Q: What is the CVSS score of EUVD-2026-54802?

EUVD-2026-54802 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

| CVE-2026-71950 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-6hpm-4f52-cv2w

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection (AV:N/AC:L/PR:N/UI:N) executing as root gives full C:H/I:H/A:H; scope unchanged as impact stays within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:33 vuln.today

CVE Published

Aug 08, 2026 - 16:52 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.

AnalysisAI

Unauthenticated remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) allows attackers to run arbitrary commands as root by injecting into the action_value parameter of the /boafrm/formSmsManage web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device compromise. No public exploit identified at time of analysis, but a vendor patch is available.

Technical ContextAI

The vulnerable component is the boa embedded web server bundled in D-Link's OpenWrt-derived router firmware, where request handlers are exposed under the /boafrm/ URI namespace. The SMS management endpoint (formSmsManage) passes the attacker-controlled action_value field into a shell context without adequate sanitization, matching CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e. 'OS Command Injection'). Because the boa server process on these consumer LTE routers typically runs as root, injected commands execute with the highest privilege level. The affected product is identified by CPE cpe:2.3:a:d-link_corporation:dwr-m961:*:*:*:*:*:*:*:*, an LTE cellular router combining 4G WAN uplink with AC1200 dual-band Wi-Fi.

RemediationAI

Vendor-released patch: firmware 1.1.5_C1_202607071108 - upgrade all DWR-M961 hardware C1 units to this version or later, obtained via the D-Link advisory at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512. Until patching is complete, restrict access to the router's web management interface: disable any remote/WAN-side management so /boafrm/ endpoints are not reachable from the internet (side effect: administrators lose off-LAN management), and on the LAN restrict management access to trusted administrative hosts or a management VLAN (side effect: added network segmentation overhead). Because exploitation targets the formSmsManage handler, disabling or restricting SMS management features where the firmware allows reduces attack surface, though core SMS functionality of the LTE router would be lost. Verify no port-forwarding or UPnP rule inadvertently exposes the HTTP management port externally.