exploit-intel.com

Critical Command Injection Vulnerability in D-Link DWR-M961 Devices

First seen 9 Aug 2026, 06:49 UTC • •74.0

Article Content

1 / 6

Browse articles

ThreatCluster •August 10, 2026 at 05:34 UTC

•CVE-2026-71954 is a critical command injection vulnerability in D-Link DWR-M961 devices.
•The vulnerability allows remote command execution with root privileges via specific fields.
•Users must upgrade to firmware version 1.1.5_C1_202607071108 or later to mitigate risks.

A critical command injection vulnerability, CVE-2026-71954, has been identified in D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. This vulnerability allows unauthenticated remote attackers to execute arbitrary commands with root privileges via the /boafrm/formL2tpv3ConfigSetup interface. The CVSS base score assigned to this vulnerability is 9.8, indicating a high level of severity. Currently, there is no public proof-of-concept or confirmed exploitation reported. Users are advised to upgrade their firmware to the latest version to mitigate the risk. If immediate patching is not feasible, restricting network access to the vulnerable interface is recommended. The vulnerability was published on August 8, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 67d ago How this analysis works

Timeline

2026-08-08

CVE-2026-71954 published

D-Link disclosed a critical command injection vulnerability affecting DWR-M961 devices with specific firmware versions.

2026-08-09

Vulnerability details reported

Exploit Intelligence and Feedly reported on the command injection vulnerability, emphasizing its severity and potential impact.

exploit-intel.com

More articles in this cluster (5)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Command Injection
T1059 - Command and Scripting Interpreter

Vulnerability (2)

CVE-2026-71954
OS Command Injection

Weakness (1)

CWE-78 - OS Command Injection

Affected Platform (1)

D-Link Dwr-m961

Relationships

CVE-2026-71954 targets D-Link Dwr-m961
OS Command Injection targets D-Link Dwr-m961
Command Injection targets D-Link Dwr-m961
T1059 - Command and Scripting Interpreter targets D-Link Dwr-m961
CVE-2026-71954 related to CWE-78 - OS Command Injection

Following this threat?

Track CVE-2026-71954 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Langflow Exposed CVE-2026-105740 is a critical remote code execution (RCE) vulnerability affecting Langflow versions prior to 1.9.0. Authenticated users can exploit this flaw by adding an MCP server with the 'Stdio' transport, allowing arbitrary OS commands to be executed without validation. The vulnerability was published on October…

OS Command Injection Flaw in SiteGuard WAF Exploited EG Secure Solutions disclosed that attackers are exploiting an OS command injection vulnerability in SiteGuard Server Edition, tracked as CVE-2026-106931. This flaw allows attackers to execute commands with root or SYSTEM privileges, affecting versions 2.20 and later, with the statistics feature enabled by default.…