External risk intelligence

D-Link DWR-M961 Command Injection Vulnerability Allows Root Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71948

This vulnerability affects a router, which is a network device typically deployed as an edge gateway. Because the vulnerable interface is part of the management or diagnostic functionality of a device commonly exposed to the internet to facilitate remote connectivity and network routing, it is likely to be reachable from the public internet in standard deployments.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A command injection vulnerability has been identified in D-Link DWR-M961 devices, allowing remote attackers to execute commands with root privileges. This issue arises from improper handling of input within a diagnostic interface, potentially enabling unauthorized control over the affected devices. The main concern is confirming relevance and exposure to our deployed assets.

Attackers can run commands on affected devices.
Routers are common internet entry points.
Confirm if these devices are in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to the vulnerable device over the internet. This would involve interacting with the `/boafrm/formDebugDiagnosticRun` interface, specifically by manipulating the 'host' field. If successful, this could allow an attacker to execute commands with the highest level of privilege on the device.

No authentication required for access.
Crafted request to debug interface.
Root command execution on device.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands with root privileges on affected devices. When supported by the advisory, this could impact the device's functionality and potentially allow for unauthorized access to network traffic or the execution of further malicious actions.

Device control could be compromised.
Attacker injects malicious commands.
Device may be used in botnets.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects D-Link DWR-M961 routers, a device often deployed at network perimeters. Responsibility for addressing this critical issue likely falls to the infrastructure or network security teams who manage these devices. The first step should be to identify all instances of the affected hardware, assess their exposure to the internet, and determine their business criticality to prioritize remediation efforts.

Infrastructure and security teams own the fix.
Verify router internet exposure and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DWR-M961?

The D-Link DWR-M961 is a 4G AC1200 LTE router. It acts as a gateway that connects local devices to the internet via cellular networks, often serving as a primary link for remote offices, home networks, or mobile setups. This hardware is designed to manage network traffic, provide Wi-Fi connectivity, and offer diagnostic tools for network administrators to monitor performance.

How does CVE-2026-71948 function as a command injection?

This vulnerability is classified as CWE-78, which refers to improper neutralization of special elements used in an OS command. Essentially, the router's diagnostic interface fails to filter user input correctly. Because the software treats this input as a command rather than data, an attacker can append their own instructions to the intended system processes, forcing the router to execute unauthorized commands with full root-level permissions.

Do I need to be authenticated to trigger this flaw?

No, this vulnerability does not require authentication. An attacker can reach the problematic diagnostic interface directly from the network. It is important to note that only requests specifically targeting the 'host' field within the `/boafrm/formDebugDiagnosticRun` interface will trigger the issue; legitimate, non-malicious interaction with other router settings or interfaces will not activate this specific command execution path.

Is my D-Link router at risk if it is behind a firewall?

Halo Surface Signal indicates that because this device is a router typically deployed as an edge gateway, the diagnostic interface is often reachable from the public internet to enable remote management. If your router's management interface is exposed to the internet, it is at higher risk. Devices positioned strictly behind robust internal firewalls that block access to this specific interface are less accessible to remote attackers.

What is the first step to address this CVE?

You should begin by creating an inventory of all D-Link DWR-M961 routers in your environment to identify which units are running affected firmware versions. Once identified, verify their internet exposure. Prioritize restricting access to the diagnostic interface or applying the official firmware update provided by D-Link to ensure the vulnerability is permanently mitigated.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.