CVE-2026-71956

CRITICAL

CVE: CVE-2026-71956 - D-Link DWR-M961 devices with hardware version C1 and software version 1Sign in to save

CVSS

9.8

CVSS v3.1

EPSS

1.7%

Exploit Prediction Score

Published

August 8, 2026

Exploitability

EPSS probability 1.7%

Description

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.

Weaknesses

CWE-78

Affected Packages

No package data available.

Aliases

CVE-2026-71956

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10512
https://www.dlink.com/middle-east/en/products/dwr-m961-4g-ac1200-lte-router
https://www.vulncheck.com/advisories/d-link-dwr-m961-command-injection-via-app-cgi