CVE-2026-71954

CVE

Threat entity extracted from intelligence sources

Frequency

3

occurrences

First Seen

August 9, 2026

Last Seen

August 9, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Command Injection Vulnerability in D-Link DWR-M961 Devices74.0

A critical command injection vulnerability, CVE-2026-71954, has been identified in D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. This vulnerability allows unauthenticated remote attackers to execute arbitrary commands with root privileges via...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical Command Injection Vulnerability in D-Link DWR-M961 Devices

Aug 9·1 sources

Related Articles (3)

CVE-2026-71954: D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup [CRITICAL] CVSS 9.8 Exploit Intelligence — Recent CVEs / 1d D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in

exploit-intel.com·Aug 9

CVE-2026-71954 INCIBE-CERT - Vulnerabilities RSS / 19h Gravedad 3.1 (CVSS 3.1 Base Score) Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)

www.incibe.es·Aug 9

CVE-2026-71954 - Exploits & Severity

Related Entities

Command Injection CWE-78 - OS Command Injection T1059 - Command and Scripting Interpreter D-Link Dwr-m961 OS Command Injection