Buffer Overflow Vulnerability in D-Link DWR-M961 Devices
CVE-2026-71957

9.3CRITICAL

Key Information:

Vendor

D-link Corporation

Status
Dwr-m961
Vendor
CVE Published:
8 August 2026

What is CVE-2026-71957?

A buffer overflow vulnerability exists in D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044. This flaw occurs in the app.cgi interface, where a remote attacker could exploit the netAcc.addlist[].name field by sending an overly long string. Successfully crafting a specific payload may allow the attacker to execute arbitrary commands on the device or cause it to crash, potentially leading to unauthorized access and device instability.

Affected Version(s)

DWR-M961 0

References

https://supportannouncement.us.dlink.com/security/publica...
vendor-advisorypatch
https://www.dlink.com/middle-east/en/products/dwr-m961-4g...
product
https://www.vulncheck.com/advisories/d-link-dwr-m961-buff...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt), Professor Le Yu of Nanjing University of Posts and Telecommunications, and Professor Xiapu Luo of The Hong Kong Polytechnic University
.