External risk intelligence

D-Link DWR-M961 Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71953

The vulnerability affects a D-Link LTE router, which is a network edge device. Management interfaces on such routers are frequently exposed to the network, and the vulnerable component is part of the web-based administrative configuration interface, which is commonly accessible to users in typical deployment scenarios.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts D-Link LTE routers, specifically the management interface, and could allow unauthorized command execution with the highest privileges. The main concern at this time is confirming relevance and exposure within our environment.

Unauthenticated remote code execution on network routers.
Affects network edge devices, a critical infrastructure component.
Confirm if this router model is in use and exposed.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending a specially crafted request to the device's web interface. This interface is exposed to the network, meaning an attacker does not need to be on the same local network as the device. The vulnerability lies within the NTP server configuration section of the device's settings. Successful exploitation allows an attacker to execute arbitrary commands on the device with the highest level of privilege.

No authentication required to access.
Injection via NTP server configuration field.
Root command execution on device.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in D-Link routers could allow an unauthenticated attacker to execute arbitrary commands with root privileges. This could occur when the router's web-based management interface is accessible, potentially impacting the router's configuration and operational integrity.

Router configuration and network control.
Injecting commands via the web interface.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects D-Link DWR-M961 LTE routers. Responsibility for addressing this likely falls to network infrastructure teams, potentially in coordination with vendor management if direct remediation by the vendor is required. The first practical step is to identify all deployed DWR-M961 devices, determine their internet reachability and business criticality, and then ascertain the accountable owner for each device to plan remediation based on risk.

Network teams should own the issue.
Verify device exposure and internet reachability.
Plan coordinated remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DWR-M961?

The D-Link DWR-M961 is an LTE router designed to provide high-speed 4G internet connectivity. It functions as a network gateway, typically acting as the boundary between a local network and the internet, allowing multiple devices to share a single cellular data connection.

What does command injection mean for CVE-2026-71953?

This vulnerability is a form of OS Command Injection (CWE-78). It means the router fails to properly filter input in the NTP server settings, allowing an attacker to insert their own system commands. Because the interface runs with root privileges, the injected commands can manipulate the device's entire operating system and core functions.

How is this vulnerability triggered?

An attacker triggers this by sending a specifically crafted request to the router's web-based management interface, specifically targeting the NTP server configuration field. Importantly, the vulnerability does not require authentication; an attacker does not need a username or password to reach or interact with this vulnerable interface.

Is my DWR-M961 router at risk?

According to Halo Surface Signal, this risk is higher for devices acting as network edge gateways. Because the vulnerable management interface is web-based, if your router is configured to allow access from the public internet, it is directly reachable by remote attackers. Devices restricted to local-only management have a smaller attack surface.

What steps should I take if I use this router?

First, identify if any DWR-M961 routers are deployed in your environment. Check the current firmware version; updates are required for any device running versions earlier than 1.1.5_C1_202607071108. If you cannot update immediately, limit access to the web management interface so that it is not reachable from the public internet.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.