Command Injection Vulnerability in D-Link DWR-M961 4G LTE Router
CVE-2026-71950

9.3CRITICAL

Key Information:

Vendor

D-link Corporation

Status
Dwr-m961
Vendor
CVE Published:
8 August 2026

What is CVE-2026-71950?

The D-Link DWR-M961 4G LTE router possesses a command injection vulnerability within the /boafrm/formSmsManage interface, affecting devices with hardware version C1 and firmware prior to 1.1.5_C1_202607071108. This security flaw allows remote attackers to inject arbitrary commands through the action_value field, leading to execution with root privileges. It is critical for users to update their devices to the latest firmware to mitigate potential exploitation risks.

Affected Version(s)

DWR-M961 0

References

https://supportannouncement.us.dlink.com/security/publica...
vendor-advisorypatch
https://www.dlink.com/middle-east/en/products/dwr-m961-4g...
product
https://www.vulncheck.com/advisories/d-link-dwr-m961-comm...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt), Professor Le Yu of Nanjing University of Posts and Telecommunications, and Professor Xiapu Luo of The Hong Kong Polytechnic University
.