Which versions of D-Link DWR-M961 are affected by EUVD-2026-54803?

The D-Link DWR-M961 4G LTE router (hardware revision C1, firmware pre-1.1.5) contains a critical unauthenticated remote command injection vulnerability (CVE-2026-71951, CVSS 9.3) allowing attackers…. A patch is available.

How to fix or mitigate EUVD-2026-54803?

Within 24 hours, inventory all D-Link DWR-M961 routers (revision C1 only) and identify firmware versions; isolate or network-segment any internet-facing instances to restrict external access. Within 7 days, deploy firmware version 1.1.5_C1_202607071108 or later to all affected devices in prioritized batches (critical infrastructure first), validating functionality after each deployment. Within 30 days, complete patch deployment to all devices, conduct log analysis for exploitation attempts prior to patching, and document the patching timeline and coverage for compliance records.

D-Link DWR-M961 EUVD-2026-54803

Q: What is the CVSS score of EUVD-2026-54803?

EUVD-2026-54803 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

| CVE-2026-71951 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-fx5p-gh5f-884v

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable web endpoint (AV:N/AC:L/PR:N/UI:N) yields root command execution, giving full C/I/A impact on the device with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:33 vuln.today

CVE Published

Aug 08, 2026 - 16:53 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.

AnalysisAI

Command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary OS commands as root by injecting into the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck.

Technical ContextAI

The DWR-M961 is a consumer/SOHO 4G AC1200 LTE router whose web management interface is served by the BOA embedded HTTP server, evident from the /boafrm/ URL prefix (formIMEISetup handler). The root cause is CWE-78 (OS Command Injection): the IMEI_value field submitted to formIMEISetup is passed into a shell command or system() call without sanitization, so shell metacharacters in the field are interpreted by the underlying OS. Because BOA-based router web servers typically run as root on these embedded Linux devices, injected commands inherit root privileges. The affected product is identified by CPE cpe:2.3:a:d-link_corporation:dwr-m961:*:*:*:*:*:*:*:*, scoped specifically to hardware version C1.

RemediationAI

Vendor-released patch: upgrade the DWR-M961 (hardware version C1) to firmware 1.1.5_C1_202607071108 or later, as directed in the D-Link advisory at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512. Until the firmware is applied, disable remote (WAN-side) web management so the /boafrm/ interface is not reachable from the internet, and restrict access to the management interface to trusted LAN hosts or a management VLAN - the trade-off is loss of remote administration convenience. Additionally, block inbound access to the router's HTTP/HTTPS management ports at any upstream firewall and change default administrative credentials; note these controls reduce but do not eliminate exposure from an attacker already on the local network, so patching remains the definitive fix.