Skip to content
OpenAdvisories
High WID-SEC-2026-2706 15 CVEs

D-LINK DWR-M961 Router: Mehrere Schwachstellen

Published Aug 9, 2026 · Updated Aug 9, 2026 · de-DE

Vendor: D-Link Product: Router

Summary

Ein Angreifer kann mehrere Schwachstellen in D-LINK DWR-M961 Router ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um einen Denial of Service Angriff durchzuführen, und um beliebigen Programmcode auszuführen.

Product

Router der Firma D-LINK enthalten eine Firewall und in der Regel eine WLAN-Schnittstelle. Die Geräte sind hauptsächlich für private Anwender und Kleinunternehmen konzipiert.

Vulnerabilities 15

  • Critical 9.8
    CVE-2026-71944

    D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71945

    D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71946

    D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the hos…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71947

    D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into t…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71948

    D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the ho…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71949

    D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue a…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71950

    D-Link DWR-M961 Command Injection via /boafrm/formSmsManage

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_valu…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71951

    D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value …

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71952

    D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71953

    D-Link DWR-M961 Command Injection via /boafrm/formNtp

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 fiel…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71954

    D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup

    D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tun…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71955

    D-Link DWR-M961 Command Injection via /boafrm/formWsc

    D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, …

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71956

    D-Link DWR-M961 Command Injection via app.cgi

    D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71957

    D-Link DWR-M961 Buffer Overflow via app.cgi

    D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbi…

    D-Link DWR-M961 Network devices
  • Critical 9.8
    CVE-2026-71958

    D-Link DWR-M961 Buffer Overflow via quicksetup.cgi

    D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and e…

    D-Link DWR-M961 Network devices

Revision history

  1. #1

    Initiale Fassung

References