A remotely exploitable buffer overflow in the quicksetup.cgi interface of D-Link DWR-M961 4G LTE routers can be triggered by unauthenticated attackers to crash the device, and, per the disclosure, may allow arbitrary command execution. NVD rates it CVSS 9.8 CRITICAL.
What Is It
CVE-2026-71958 is a classic buffer overflow (CWE-120) in the quicksetup.cgi interface exposed by D-Link DWR-M961 routers. A remote attacker can write overly long strings into the test4, ssid2, and username fields. A less precise overflow simply crashes the device; the disclosure reports that a crafted payload can escalate this to arbitrary command execution, though no public proof-of-concept demonstrating reliable code execution has been reviewed here.
The flaw was disclosed via VulnCheck ([email protected]) and published to NVD on 2026-08-08.
Why It Matters
The CVSS 3.1 vector recorded by NVD is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8. Under CVSS 4.0 it scores 9.3 CRITICAL. Every exploitability dimension is maxed out: network reachable, low attack complexity, no privileges, no user interaction. Impact is scored high across confidentiality, integrity, and availability.
If the code-execution outcome holds in practice, that combination describes a pre-authentication remote code execution bug on an internet-facing edge device, and a router that falls to this is not just a compromised host, it is the gateway for everything behind it. Even discounting that outcome entirely, the same overflow remains a trivial denial-of-service against the connection.
The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of publication, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: D-Link Corporation
- Product: DWR-M961 (4G AC1200 LTE router)
- Hardware version cited in the disclosure: C1
- Software version cited in the disclosure: 1.1.2_C1_202602110044
- Affected range: all versions prior to
1.1.5_C1_202607071108(default status: affected)
Patch Status
Fixed in software version 1.1.5_C1_202607071108. Anything below that build is affected. D-Link has published a support announcement for this issue (SAP10512).
With no KEV listing, no federal remediation deadline applies. Operators should upgrade to 1.1.5_C1_202607071108 or later and, until patched, ensure the router's web management interface is not reachable from the WAN.
Sources
- NVD entry for CVE-2026-71958; https://nvd.nist.gov/vuln/detail/CVE-2026-71958
- D-Link Security Support Announcement SAP10512; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512
- VulnCheck Advisory: D-Link DWR-M961 Buffer Overflow via quicksetup.cgi; https://www.vulncheck.com/advisories/d-link-dwr-m961-buffer-overflow-via-quicksetup-cgi
- D-Link DWR-M961 Product Page; https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router