Which versions of D-Link DWR-M961 are affected by EUVD-2026-54809?

D-Link DWR-M961 routers (firmware 1.1.2_C1_202602110044) contain a critical remote code execution vulnerability allowing unauthenticated attackers to achieve arbitrary command execution or crash the…. A patch is available.

How to fix or mitigate EUVD-2026-54809?

Within 24 hours, identify and inventory all D-Link DWR-M961 devices (hardware C1) across your organization and apply the vendor patch from D-Link advisory SAP10512 immediately. Within 7 days, verify patch deployment on all affected devices, conduct network connectivity testing to ensure remediation stability, review device logs for signs of exploitation attempts, and validate backup connectivity paths. Within 30 days, update your device management system with the patched firmware version, conduct a security incident assessment to determine if the vulnerability was exploited before patching, and implement a firmware update policy ensuring timely deployment of security patches to all network infrastructure devices.

D-Link DWR-M961 EUVD-2026-54809

Q: What is the CVSS score of EUVD-2026-54809?

EUVD-2026-54809 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-71957 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-08-08 VulnCheck

GHSA-6hx4-fgxm-92r2

Buffer Overflow D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable CGI overflow with low complexity (AV:N/AC:L/PR:N/UI:N) giving full command execution on the device, so C/I/A all High and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:50 vuln.today

CVE Published

Aug 08, 2026 - 17:06 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

AnalysisAI

Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow a stack/heap buffer via an overly long netAcc.addlist[].name value sent to the app.cgi interface, achieving arbitrary command execution or a device crash. Reported by VulnCheck with a CVSS 4.0 base of 9.3, the flaw is remotely reachable with no authentication or user interaction; no public exploit code has been identified at time of analysis. A vendor patch is available via D-Link advisory SAP10512.

Technical ContextAI

The DWR-M961 is a consumer/SOHO 4G LTE router whose web management logic is served through a CGI binary (app.cgi). The vulnerability is a classic CWE-120 buffer copy without size checking: the netAcc.addlist[].name parameter - part of the router's network-access/account list configuration handling - is copied into a fixed-size buffer without bounds validation. Because embedded CGI handlers in such routers are typically compiled C running as root with no memory-safety mitigations (often lacking stack canaries/ASLR), an over-length string overruns the buffer, corrupting adjacent memory or the return address. A crafted payload can redirect execution to attacker-controlled shellcode or command strings, while a merely long-but-unstructured string corrupts the stack and crashes the process (denial of service). The affected product is identified by CPE cpe:2.3:a:d-link_corporation:dwr-m961:*:*:*:*:*:*:*:*.

RemediationAI

Apply the vendor-provided fix per D-Link security advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512) - Patch available per vendor advisory; the exact fixed firmware build should be taken directly from that advisory as it was not enumerated in the input, so do not deploy an assumed version number. As compensating controls until patching, disable remote/WAN-side web administration so app.cgi is not reachable from the internet (trade-off: loss of remote management convenience), restrict access to the management interface to a trusted management VLAN or specific admin IPs via ACLs, and place the router's admin interface behind a firewall blocking inbound access to the HTTP management port from untrusted networks. Given this is a SOHO device, also verify no port-forwarding or UPnP rule inadvertently exposes the management CGI.