CVE-2026-71954

CRITICAL

CVE: CVE-2026-71954 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1Sign in to save

CVSS

9.8

CVSS v3.1

EPSS

2.1%

Exploit Prediction Score

Published

August 8, 2026

Exploitability

EPSS probability 2.1%

Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.

Weaknesses

CWE-78

Affected Packages

No package data available.

Aliases

CVE-2026-71954

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512
https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router
https://www.vulncheck.com/advisories/d-link-dwr-m961-command-injection-via-boafrm-forml2tpv3configsetup