D-Link has released firmware updates for 18 reported security findings affecting the web management interface of its DWR-M961 4G LTE router (hardware revision C1).
The flaws, tracked under 15 CVE identifiers, include numerous command injection issues and three buffer overflow vulnerabilities.
The affected device was running firmware version 1.1.2_C1_202602110044. D-Link addressed the reported issues in firmware version 1.1.5_C1_202607071108, released for the DWR-M961 C1 hardware revision.
D-Link Fixes 18 Security Flaws
Most of the flaws reside in CGI handlers used by the router’s administrative web interface. Command injection issues affect FOTA update functions, network diagnostic tools, USSD and SMS operations, SIM configuration, NTP settings, L2TPv3 configuration, and WPS functionality.
An attacker who can submit crafted input to a vulnerable management interface could cause router-side commands to be processed unexpectedly.
According to D-Link’s advisory, the particularly notable areas include Ping, Traceroute, and Debug diagnostics, where user-controlled host values were reported to be vulnerable.
The L2TPv3 issue is classified as stored command injection. It involves storing crafted tunnelid or sessionid values through one configuration request, followed by a subsequent request that causes the stored values to be used in a system command.
Three WPS-related findings share CVE-2026-71955. The affected formWsc handler includes local PIN, peer PIN, and target SSID input paths. One finding specifically noted insufficient neutralization of the dollar-sign character in a double-quoted command context.
D-Link also fixed buffer-overflow vulnerabilities in app.cgi and quicksetup.cgi. CVE-2026-71957 affects the access-control configuration path in app.cgi, specifically the netAcc.addlist[].name object value.
CVE-2026-71958 covers two separate quicksetup.cgi findings: a test4 request-processing flaw and overflows in Wi-Fi and administrator setup parameters, involving ssid2 and username.
| CVE | Affected component / input | Vulnerability type |
|---|---|---|
| CVE-2026-71944 | formLtefotaUpgradeQuectel / fota_url | Command injection |
| CVE-2026-71945 | formLtefotaUpgradeFibocom / fota_url | Command injection |
| CVE-2026-71946 | formPingDiagnosticRun / host | Command injection |
| CVE-2026-71947 | formTracerouteDiagnosticRun / host, ipVer | Command injection |
| CVE-2026-71948 | formDebugDiagnosticRun / host | Command injection |
| CVE-2026-71949 | formUSSDSetup / ussdValue, selectMenuValue | Command injection |
| CVE-2026-71950 | formSmsManage / action_value | Command injection |
| CVE-2026-71951 | formIMEISetup / IMEI_value | Command injection |
| CVE-2026-71952 | formPinManageSetup / oldPIn | Command injection |
| CVE-2026-71953 | formNtp / ntpServerIp1 | Command injection |
| CVE-2026-71954 | formL2tpv3ConfigSetup / tunnelid, sessionid | Stored command injection |
| CVE-2026-71955 | formWsc / WPS PIN and SSID fields | Command injection |
| CVE-2026-71956 | app.cgi / netDig.ping.dst | Command injection |
| CVE-2026-71957 | app.cgi / netAcc.addlist[].name | Buffer overflow |
| CVE-2026-71958 | quicksetup.cgi / test4, ssid2, username | Buffer overflow |
DWR-M961 owners should confirm their router is hardware revision C1 and install firmware version 1.1.5_C1_202607071108 or later through the appropriate regional D-Link support channel.
Administrators should also verify the installed version through the router’s web interface and avoid applying firmware intended for a different hardware revision.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
.){kind=link}