SYS::ONLINE
Wasteland.
Briefs1798
Issues22
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-71956 2026-08-08

CVE-2026-71956: Critical Command Injection in D-Link DWR-M961 Routers

"A remote, unauthenticated attacker can inject arbitrary commands into the `app.cgi` interface of D-Link DWR-M961 4G LTE routers and execute them with root privileges."

A remote, unauthenticated attacker can inject arbitrary commands into the app.cgi interface of D-Link DWR-M961 4G LTE routers and execute them with root privileges.

What Is It

CVE-2026-71956 is an OS command injection flaw (CWE-78) in the app.cgi interface of the D-Link DWR-M961. User-supplied input to the netDig.ping.dst field is passed to the underlying system without adequate sanitization, allowing an attacker to append arbitrary commands. Execution occurs as root.

The vulnerability was disclosed by VulnCheck and carries a CVSS v3.1 base score of 9.8 (CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). VulnCheck also assigned a CVSS v4.0 score of 9.3 (CRITICAL). Per the NVD record for CVE-2026-71956 (linked in Sources), which carries both scores as supplied by VulnCheck as CNA, the entry was published on 2026-08-08 and is currently in "Received" status; meaning NVD has not yet completed its own analysis and has not independently assigned scores or product configuration data.

Why It Matters

Every element of the attack path favors the attacker: network vector, low complexity, no privileges required, and no user interaction. A single crafted request to app.cgi yields root-level code execution with full confidentiality, integrity, and availability impact.

The DWR-M961 is a 4G/LTE consumer and small-business gateway; an internet-facing device that typically sits at the network edge. Root compromise of the router hands over traffic interception, persistence, pivot access to the internal network, and botnet enlistment. Embedded routers are historically slow to patch and rarely monitored, so exposure windows tend to be long.

As of 2026-08-08, CVE-2026-71956 is not listed in the CISA Known Exploited Vulnerabilities catalog (verifiable against the catalog itself, linked in Sources), so there is no confirmed in-the-wild exploitation and no associated KEV remediation deadline at this time. That should not be read as low risk given the exploitability profile, and the catalog should be rechecked as it is updated.

What's Vulnerable

Patch Status

Fixed firmware is available. Upgrade DWR-M961 (hardware version C1) devices to software version 1.1.5_C1_202607071108 or later. D-Link has published a security announcement (SAP10512) covering this issue. Until firmware is applied, restrict access to the device's web management interface, particularly from WAN-facing interfaces.

Sources