A pre-authentication command injection flaw in D-Link DWR-M961 4G routers lets remote attackers execute arbitrary commands as root, rated CVSS 9.8 CRITICAL.
What Is It
CVE-2026-71944 is an OS command injection vulnerability (CWE-78) in D-Link DWR-M961 devices running hardware version C1. The flaw lives in the /boafrm/formLtefotaUpgradeQuectel interface, which handles firmware-over-the-air upgrade requests for the device's Quectel LTE module. Input supplied in the fota_url field is passed through without adequate sanitization, allowing a remote attacker to inject arbitrary commands that execute with root privileges.
The vulnerability was disclosed via VulnCheck and published to NVD on 2026-08-08, currently in "Received" status.
Why It Matters
The CVSS v3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 secondary score of 9.3 (CRITICAL) was also assigned. The scoring reflects the worst-case combination for an edge device: network-reachable, low attack complexity, no privileges required, and no user interaction. Confidentiality, integrity, and availability impacts are all rated HIGH.
Successful exploitation yields root-level command execution on the router itself; full control of the device that sits between the internal network and the internet.
There is no CISA KEV entry for this CVE in the supplied source material, and no confirmation of active exploitation in the wild.
What's Vulnerable
- Vendor: D-Link Corporation
- Product: DWR-M961 (4G AC1200 LTE Router)
- Hardware version: C1
- Affected firmware: all versions before
1.1.5_C1_202607071108 - Vulnerable endpoint:
/boafrm/formLtefotaUpgradeQuectel,fota_urlparameter
Patch Status
D-Link has published a security advisory (SAP10512) covering this issue. Firmware version 1.1.5_C1_202607071108 and later are not affected; the supplied data indicates upgrading to that build or newer is the remediation path. No KEV-mandated remediation deadline applies, as this CVE is not present in the supplied KEV data.
Sources
- NVD, CVE-2026-71944: https://nvd.nist.gov/vuln/detail/CVE-2026-71944
- D-Link Security Advisory SAP10512: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512
- VulnCheck Advisory; D-Link DWR-M961 Command Injection: https://www.vulncheck.com/advisories/d-link-dwr-m961-command-injection-via-boafrm-formltefotaupgradequectel
- D-Link DWR-M961 Product Page: https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router