Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.
An unauthenticated attacker over the network can inject arbitrary commands into the tunnelid and sessionid fields to execute arbitrary commands with root privileges on the device.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available in firmware version 1.1.5_C1_202607071108 and later.
Upgrade D-Link DWR-M961 devices to firmware version 1.1.5_C1_202607071108 or later. Restrict network access to the /boafrm/formL2tpv3ConfigSetup interface if immediate patching is not possible. Monitor for suspicious L2TPv3 configuration attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2026-71954
A CVSS base score of 9.8 has been assigned.
Feedly found the first article mentioning CVE-2026-71954 . See article
A critical command injection vulnerability exists in D-Link DWR-M961 devices running hardware version C1 with firmware older than 1.1.5_C1_202607071108, carrying a CVSS score of 9.8. Exploitation allows remote attackers to execute arbitrary commands with root privileges, although no public proof-of-concept exploits are currently available. To mitigate this risk, users must update to the specified firmware version, as the vulnerability is present in all earlier releases. See article
GitHub Advisories released a security advisory .
CVE-2026-71954 - Exploits & Severity - Feedly
D-Link DWR-M961 Root Command Injection (CVE-2026-71954)
Critical Command Injection Vulnerability in D-Link DWR-M961 Devices
CVE-2026-71954 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3…
CVE-2026-71954 - Exploits & Severity - Feedly
CVE-2026-71954: D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup [CRITICAL] CVSS 9.8
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
