Dwr M961

Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow stack/heap buffers in the quicksetup.cgi handler by submitting oversized test4, ssid2, and username field values, gaining arbitrary command execution or crashing the device. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware 1.1.2_C1_202602110044) allows an unauthenticated attacker to overflow a stack/heap buffer via an overly long netAcc.addlist[].name value sent to the app.cgi interface, achieving arbitrary command execution or a device crash. Reported by VulnCheck with a CVSS 4.0 base of 9.3, the flaw is remotely reachable with no authentication or user interaction; no public exploit code has been identified at time of analysis. A vendor patch is available via D-Link advisory SAP10512.

OS command injection in the D-Link DWR-M961 4G LTE router (hardware C1, firmware 1.1.2_C1_202602110044) lets a remote attacker inject arbitrary shell commands through the netDig.ping.dst parameter of the app.cgi diagnostic interface, yielding command execution as root. The flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; a vendor patch is available (SAP10512), and no public exploit has been identified at time of analysis.

OS command injection in the D-Link DWR-M961 4G AC1200 LTE router (hardware C1, firmware before 1.1.5_C1_202607071108) lets a remote, unauthenticated attacker inject shell commands through the localPin parameter of the /boafrm/formWsc (WPS) endpoint, yielding command execution as root. The flaw carries a CVSS 4.0 score of 9.3 and was reported by VulnCheck; a vendor patch exists (SAP10512), but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary commands as root by injecting shell metacharacters into the tunnelid and sessionid parameters of the /boafrm/formL2tpv3ConfigSetup web interface. The flaw was reported by VulnCheck and a vendor patch is available (D-Link SAP10512); no public exploit identified at time of analysis. The CVSS 4.0 vector rates it 9.3 with full confidentiality, integrity, and availability impact on the router.

Remote OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets an attacker execute arbitrary commands as root by supplying shell metacharacters in the ntpServerIp1 parameter of the /boafrm/formNtp web interface. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable exploitation with no authentication and no user interaction, yielding full compromise (VC:H/VI:H/VA:H). No public exploit was identified at time of analysis, and it is not listed in CISA KEV; a vendor firmware patch is available.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the oldPIn parameter of the /boafrm/formPinManageSetup web endpoint. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device takeover. No public exploit is identified at time of analysis, and the CVE is not listed in CISA KEV.

Command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets remote attackers execute arbitrary OS commands as root by injecting into the IMEI_value parameter of the /boafrm/formIMEISetup endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck.

Unauthenticated remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) allows attackers to run arbitrary commands as root by injecting into the action_value parameter of the /boafrm/formSmsManage web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw requires no authentication or user interaction and yields full device compromise. No public exploit identified at time of analysis, but a vendor patch is available.

OS command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets a remote attacker execute arbitrary commands as root through the /boafrm/formUSSDSetup web interface. Unsanitized input in the ussdValue and selectMenuValue parameters is passed to a shell, giving full device takeover with high confidentiality, integrity, and availability impact (CVSS 4.0 9.3). Reported by VulnCheck; no public exploit identified at time of analysis, and a vendor patch is available.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting into the host field of the /boafrm/formDebugDiagnosticRun diagnostic interface. Reported by VulnCheck and rated CVSS 4.0 9.3 (Critical), it gives full device takeover with no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not currently listed in CISA KEV.

Remote command execution in the D-Link DWR-M961 4G AC1200 LTE router (hardware version C1, firmware before 1.1.5_C1_202607071108) allows unauthenticated attackers to run arbitrary OS commands as root by injecting into the host and ipVer parameters of the /boafrm/formTracerouteDiagnosticRun web interface. The CVSS 4.0 score of 9.3 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not in CISA KEV, but a vendor patch has been released and the finding was reported by VulnCheck.

Remote command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware prior to 1.1.5_C1_202607071108) lets unauthenticated attackers run arbitrary OS commands as root by abusing the host parameter of the /boafrm/formPingDiagnosticRun ping-diagnostic endpoint. The CVSS 4.0 base score is 9.3 (critical) with a fully remote, no-privilege, no-interaction vector, giving complete device takeover. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the trivially exploitable vector and VulnCheck reporting make this a high-priority patch.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) allows attackers to run arbitrary OS commands as root by injecting into the fota_url parameter of the /boafrm/formLtefotaUpgradeFibocom endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms it is reachable over the network with no authentication or user interaction, yielding full high-impact compromise (VC:H/VI:H/VA:H). Reported by VulnCheck with a vendor patch now available; no public exploit identified at time of analysis.

Remote unauthenticated command injection in the D-Link DWR-M961 4G LTE router (hardware revision C1, firmware before 1.1.5_C1_202607071108) lets attackers execute arbitrary OS commands as root by injecting shell metacharacters into the fota_url parameter of the /boafrm/formLtefotaUpgradeQuectel web interface. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw yields full device takeover with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability makes it a strong candidate for weaponization.