Which versions of D-Link DWR-M961 are affected by EUVD-2026-54805?

D-Link DWR-M961 4G LTE routers (hardware revision C1, firmware before 1.1.5) are vulnerable to unauthenticated remote code execution that grants root-level system compromise.. A patch is available.

How to fix or mitigate EUVD-2026-54805?

Within 24 hours: conduct rapid inventory of all D-Link DWR-M961 devices in production and identify those directly exposed to untrusted networks. Within 7 days: deploy firmware update 1.1.5_C1_202607071108 or later to all affected devices, beginning with internet-facing and business-critical deployments. Within 30 days: complete patching across all remaining devices, audit system logs for exploitation attempts (command injection payloads or unusual root process execution during the vulnerability window), and conduct incident response assessment if unauthorized access is detected.

D-Link DWR-M961 EUVD-2026-54805

Q: What is the CVSS score of EUVD-2026-54805?

EUVD-2026-54805 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.1%.

| CVE-2026-71953 CRITICAL

OS Command Injection (CWE-78)

2026-08-08 VulnCheck

GHSA-mc5m-j5gw-mffg

Command Injection D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection (AV:N/AC:L/PR:N/UI:N) executing as root yields full C/I/A loss; scope unchanged as impact stays within the device OS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:34 vuln.today

CVE Published

Aug 08, 2026 - 16:53 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.

AnalysisAI

Remote OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets an attacker execute arbitrary commands as root by supplying shell metacharacters in the ntpServerIp1 parameter of the /boafrm/formNtp web interface. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no authentication and no user interaction, yielding full compromise (VC:H/VI:H/VA:H). No public exploit was identified at time of analysis, and it is not listed in CISA KEV; a vendor firmware patch is available.

Technical ContextAI

The DWR-M961 is a consumer/SOHO 4G AC1200 LTE router whose web management interface is served by the embedded BOA HTTP server (the /boafrm/ path prefix is characteristic of BOA-based D-Link firmware). The flaw is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the formNtp handler passes the user-controlled ntpServerIp1 value into a system shell call - most likely to configure or invoke an NTP client - without sanitizing shell metacharacters. Because the web server and its spawned processes run as root on this class of embedded device, injected commands inherit root privileges. The affected component is identified by cpe:2.3:a:d-link_corporation:dwr-m961, scoped specifically to hardware version C1.

RemediationAI

Vendor-released patch: upgrade DWR-M961 (hardware C1) to firmware 1.1.5_C1_202607071108 or later, as directed in D-Link security announcement SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512). Until the firmware is applied, reduce exposure by ensuring remote/WAN management of the web interface is disabled so the /boafrm/formNtp endpoint is not reachable from the internet (trade-off: administrators lose remote configuration convenience), and restrict LAN-side access to the management UI to trusted hosts or management VLANs only. Avoid exposing the NTP configuration page to untrusted networks; where feasible, place the device behind a firewall that blocks inbound access to the HTTP management port. These are compensating controls only - the firmware update is the definitive fix.