Command Injection in D-Link Router Affects Multiple Devices
CVE-2026-71944

9.3CRITICAL

Key Information:

Vendor

D-link Corporation

Status
Dwr-m961
Vendor
CVE Published:
8 August 2026

What is CVE-2026-71944?

D-Link DWR-M961 devices with certain hardware and firmware versions are susceptible to a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. This security flaw allows a remote attacker to exploit the fota_url field to inject arbitrary malicious commands. Successful exploitation can lead to command execution with root privileges, potentially compromising the device's integrity and security.

Affected Version(s)

DWR-M961 0

References

https://supportannouncement.us.dlink.com/security/publica...
vendor-advisorypatch
https://www.dlink.com/middle-east/en/products/dwr-m961-4g...
product
https://www.vulncheck.com/advisories/d-link-dwr-m961-comm...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt), Professor Le Yu of Nanjing University of Posts and Telecommunications, and Professor Xiapu Luo of The Hong Kong Polytechnic University
.