External risk intelligence

D-Link DWR-M961 Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71944

The vulnerability exists in a 4G LTE router, a device typically deployed at the network edge to provide internet connectivity. As a network gateway product, its management and configuration interfaces are frequently accessible via the network, making it a likely candidate for exposure in common deployment scenarios.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A command injection vulnerability has been identified in D-Link DWR-M961 devices. This flaw allows remote attackers to execute arbitrary commands with full system privileges by manipulating a specific interface field. The primary concern is to confirm whether these devices are in use and if they are exposed to this risk.

Unrestricted commands can be run remotely.
Potential for unauthorized system control.
Confirm device presence and network exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the device over the network. This request targets the firmware upgrade interface, specifically the `fota_url` field within the `/boafrm/formLtefotaUpgradeQuectel` component. If successful, the attacker can execute arbitrary commands with root privileges on the affected device.

No authentication or user interaction needed.
Inject malicious commands into the `fota_url` field.
Achieve remote code execution with root privileges.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in D-Link DWR-M961 devices could allow an unauthenticated remote attacker to execute arbitrary commands with root privileges by providing specially crafted input to the `fota_url` field in a specific interface. This could occur when the device is accessible from the internet.

Device command execution and control.
Remote attacker injects commands via URL.
Full device compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

D-Link DWR-M961 4G LTE routers are likely managed by network or infrastructure teams, with vendor-management teams also playing a role if the devices were procured through a third party. The immediate first step is to locate all instances of these devices, determine their network exposure and business criticality, and identify the accountable owner before planning remediation.

Network or Infrastructure team ownership.
Verify device network exposure.
Plan and coordinate remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DWR-M961?

The D-Link DWR-M961 is a 4G LTE router designed to provide wireless internet connectivity. These devices act as a gateway, often serving as the primary bridge between a local network and the broader internet. Because they function as network infrastructure, they are frequently used in remote or branch office locations to manage data traffic.

What does command injection mean for CVE-2026-71944?

Command injection is a vulnerability class (CWE-78) where an application incorrectly processes user-supplied input, allowing it to be executed as a system command. In this CVE, the device fails to sanitize data in the firmware update field, granting an attacker the ability to run their own commands directly on the device with root-level, or administrative, control.

How is this command injection triggered?

An attacker triggers this by sending a specially crafted network request to the device's firmware upgrade interface, specifically the 'fota_url' field. This does not require the attacker to have a valid login or any prior user interaction. Legitimate system activities or standard traffic unrelated to this specific upgrade interface do not trigger the bug.

Do I need to worry if my device is internal?

Halo Surface Signal notes that while internet-facing devices are at the highest risk, you should assess any instance where the management interface is reachable. If the device's configuration panel is accessible from anywhere outside of a strictly controlled, trusted administrative network, it is potentially reachable by an attacker.

How should I respond to this threat?

Your first step is to create an inventory of all DWR-M961 units in your environment. Once identified, confirm their current firmware version and network accessibility. If they are running versions older than 1.1.5_C1_202607071108, prioritize them for updates or restrict their network access to prevent remote reachability while you coordinate the official vendor fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.