External risk intelligence

D-Link DWR-M961 Command Execution via Buffer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71957

The affected product is an LTE router, which is a network edge device. The vulnerability resides in the web-based management interface (app.cgi), which is typically exposed on the device's network-facing gateway for administrative access.

Buffer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical buffer overflow vulnerability in D-Link DWR-M961 devices. The issue exists in the `app.cgi` interface, allowing remote attackers to potentially execute arbitrary commands or cause a device crash by sending a crafted, overly long string. Given the nature of LTE routers as network edge devices, this vulnerability warrants attention to confirm relevance and exposure.

Remote attackers can crash or control affected devices.
Network edge devices are often targets for broad disruption.
Confirm relevance and exposure for network-critical devices.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by accessing the device's web interface over the network. By sending specially crafted input to the `app.cgi` interface, specifically to the `netAcc.addlist[].name` field, they can trigger a buffer overflow. This overflow can allow the attacker to execute arbitrary commands on the device or cause it to crash, potentially leading to a full system compromise.

Attacker requires network access.
Vulnerable component is `app.cgi`.
Risk includes arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow vulnerability in the D-Link DWR-M961 device's app.cgi interface could allow a remote attacker to execute arbitrary commands or cause a denial of service. This could occur when an attacker sends an overly long string to the `netAcc.addlist[].name` field.

Device configuration and control.
Remote network access with crafted input.
Command execution or device instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The operational teams responsible for D-Link DWR-M961 LTE routers, likely infrastructure or network management, should prioritize confirming the reachability and business criticality of these devices. The first step involves identifying all deployed instances, assessing their exposure, and locating the accountable owner before planning any remediation.

Infrastructure or network teams own resolution.
Verify device reachability and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DWR-M961?

The D-Link DWR-M961 is an LTE router used to provide internet connectivity, often acting as a network gateway for homes or small offices. It uses a web-based interface for configuration and management, which allows administrators to set up network settings, manage access, and oversee connected devices.

What is a buffer overflow in CVE-2026-71957?

A buffer overflow occurs when a program writes more data to a memory area, or buffer, than it is designed to hold. In this case, categorized as CWE-120, the vulnerability allows an attacker to send an unusually long string to a specific field. This extra data spills over into adjacent memory, which can corrupt the system's operations and potentially allow an attacker to run their own commands.

How does an attacker trigger this vulnerability?

An attacker triggers the vulnerability by sending a specially crafted, overly long string to the 'netAcc.addlist[].name' field within the router's 'app.cgi' interface. This does not happen through normal usage or standard web browsing; it requires specific, malicious input directed at the management interface. Simply visiting the login page or using the router for standard traffic does not trigger the bug.

Is my D-Link DWR-M961 at risk?

According to Halo Surface Signal, this router acts as a network edge device, and the affected management interface is often exposed to the network for administrative tasks. If your device is accessible over the internet or reachable by unauthorized users on your local network, it faces a higher risk. You should check if your management interface is reachable from outside your trusted network.

What should I do if I use these routers?

The first step is to locate all D-Link DWR-M961 devices in your environment to understand your footprint. Once identified, confirm whether each device's administrative interface is accessible via the network. Prioritize those that are reachable from the outside, and verify the device's business criticality to determine the urgency of your response and planning.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.