CVE-2026-71984

MSI Radix AXE6600 router firmware v781521 includes a command-injection vulnerability in the urlfilter function that allows remote command execution and potential root privileges on the device. Affected component: urlfilter in the firmware; impact includes high confidentiality, integrity, and avai...

CVE-2026-71984

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root...

CVE-2026-71983 MSI Radix AXE6600 v781521 Command Injection via wps.cgi

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized...

CVE-2026-71951

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71952

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution...

CVE-2026-71953

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with...

CVE-2026-71946

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71945

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71947

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in...

CVE-2026-71955

CVE-2026-71955 affects D-Link DWR-M961 devices (hardware version C1). Multiple sources show a command-injection vulnerability in the /boafrm/formWsc interface that allows a remote attacker to inject arbitrary commands via the localPin field, leading to root-level command execution. Affected firmw...

CVE-2026-71954

D-Link DWR-M961 devices with hardware version C1 and firmware before 1.1.5_C1_202607071108 are affected by a command injection in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary commands into the tunnelid and sessionid fields, leading to root-level command exec...

CVE-2026-71954 D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in...

CVE-2026-71953 D-Link DWR-M961 Command Injection via /boafrm/formNtp

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with...

CVE-2026-71953

Summary: CVE-2026-71953 affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. A command injection vulnerability exists in the /boafrm/formNtp interface, where an attacker can supply a malicious value to ntpServerIp1, leading to remote command exec...

EUVD-2026-54804

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution...

CVE-2026-71951

D-Link DWR‑M961 devices with hardware version C1 and firmware prior to 1.1.5_C1_202607071108 are affected by a remote command‑injection in the /boafrm/formIMEISetup interface. The vulnerability allows an attacker to inject commands via the IMEI_value field, resulting in command execution with roo...

EUVD-2026-54803

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71950

Affected product: D-Link DWR-M961 (hardware version C1). Vulnerable condition: firmware versions prior to 1.1.5_C1_202607071108. Root-cause: command injection in the /boafrm/formSmsManage interface allowing an attacker to inject commands via the action_value field. Impact: remote command executio...

EUVD-2026-54802

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the actionvalue field, resulting in command execution...

EUVD-2026-54801

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in...