Which versions of D-Link DWR-M961 are affected by EUVD-2026-54810?

A critical remote code execution vulnerability in D-Link's DWR-M961 4G LTE router allows unauthenticated network-based attackers to execute arbitrary commands on affected devices, directly…. A patch is available.

How to fix or mitigate EUVD-2026-54810?

Within 24 hours: Identify all D-Link DWR-M961 routers (hardware revision C1, firmware 1.1.2_C1_202602110044) currently deployed across the organization and confirm their current firmware versions. Within 7 days: Apply the vendor-released patch to all affected devices, prioritizing production network segments, and verify successful firmware updates are installed and confirmed functional. Within 30 days: Review network access logs for any suspicious or unauthorized access attempts to router management interfaces during the vulnerability window, implement network-layer access controls to restrict administrative access to these devices from untrusted networks, and establish automated firmware update processes for all network appliances to prevent similar exposure windows.

D-Link DWR-M961 EUVD-2026-54810

Q: What is the CVSS score of EUVD-2026-54810?

EUVD-2026-54810 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-71958 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-08-08 VulnCheck

GHSA-8mjf-qrcg-h2cj

Buffer Overflow D-Link Dwr M961 D Link Corporation

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable CGI overflow (AV:N/AC:L/PR:N/UI:N) yielding command execution as root with device crash gives full C/I/A; scope unchanged as impact stays within the device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 17:50 vuln.today

CVE Published

Aug 08, 2026 - 17:07 cve.org

CRITICAL 9.3

DescriptionCVE.org

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

AnalysisAI

Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow stack/heap buffers in the quicksetup.cgi handler by submitting oversized test4, ssid2, and username field values, gaining arbitrary command execution or crashing the device. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is quicksetup.cgi, a CGI endpoint in the router's embedded web administration interface used for initial device provisioning (SSID, credentials, and test parameters). The root cause is CWE-120 (Classic Buffer Copy Without Checking Size of Input), meaning the CGI copies attacker-supplied field data (test4, ssid2, username) into fixed-size memory buffers without bounds validation. On typical MIPS/ARM SOHO router firmware, such an overflow corrupts adjacent stack memory or the saved return address, enabling control-flow hijack and command execution in the context of the web server process, which on these devices commonly runs as root. The single affected CPE is cpe:2.3:a:d-link_corporation:dwr-m961, confirming the DWR-M961 product line as the target.

RemediationAI

Apply the vendor fix: a patch is available per D-Link security advisory SAP10512 (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512) - consult that advisory for the exact patched firmware build for hardware C1, as a specific fixed version string was not included in the source data (Patch status: Patch available per vendor advisory; released patched version not independently confirmed here). Until the updated firmware is installed, disable remote/WAN-side web management so quicksetup.cgi is not reachable from the internet (trade-off: administrators must be on the LAN to manage the device), restrict access to the administrative interface to trusted management hosts or VLANs, and place the router behind an upstream firewall blocking inbound access to its HTTP admin port. Where the quick-setup wizard is no longer needed post-provisioning, ensure the device is fully configured so the setup path is not left exposed.