CVE-2026-71944

The CVE-2026-71944 vulnerability affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. A command-injection flaw exists in the /boafrm/formLtefotaUpgradeQuectel interface, where an attacker can inject arbitrary commands through the fota_url field, ...

PT-2026-5307

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 version 1.1.47 Description A flaw exists in D-Link DWR-M961 version 1.1.47 that allows for command injection. This issue is related to the sub 419920 function within the /boafrm/formLtefotaUpgradeQuectel file. Manipulation of t...

PT-2026-5365

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 version 1.1.47 Description A security issue exists in D-Link DWR-M961 version 1.1.47. Manipulation of the fota url argument within an unknown function of the /boafrm/formLtefotaUpgradeFibocom file can lead to command injection...