Article - ThreatCluster

Ciberseguridadlatam •Redacción CSL • August 10, 2026

# D-Link DWR-M961 expone ejecución remota sin credenciales — falla crítica en routers 4G usados en LATAM Un buffer overflow en la interfaz web del modelo DWR-M961 permite tomar control total del dispositivo desde internet sin autenticación previa. El National Vulnerability Database clasificó el 10 de agosto de 2026 como crítica la vulnerabilidad CVE-2026-71957, que […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in D-Link DWR-M961 Routers Expose Users to Remote Attacks D-Link's 4G routers, specifically the DWR-M961 model, have been found to contain multiple critical vulnerabilities allowing remote code execution without authentication. CVE-2026-71953 and CVE-2026-71952 permit attackers to execute arbitrary commands as root via NTP server field injection and PIN management field exploitation, respectively. Additionally, CVE-2026-71957 involves a buffer overflow in the web interface, enabling total device control. These vulnerabilities affect both corporate and home networks across Latin America. The National Vulnerability Database classified these issues as critical on August 10, 2026, prompting urgent advisories for users to secure their devices. D-Link has not yet released patches or updates to mitigate these vulnerabilities. 3 sources 70

Extracted Entities

CVEs (1)

CVE-2026-71957

CWE Weaknesses (1)

CWE-120 - Classic Buffer Overflow