CVE-2026-71945 D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71945

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71944 D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71944

The CVE-2026-71944 vulnerability affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. A command-injection flaw exists in the /boafrm/formLtefotaUpgradeQuectel interface, where an attacker can inject arbitrary commands through the fota_url field, ...

CVE-2026-71945: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71951: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71958: Buffer Copy without Checking Size of Input

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

PT-2026-69215

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 versions prior to 1.1.5 C1 202607071108 Description A command injection issue exists in the '/boafrm/formUSSDSetup' endpoint. A remote attacker can inject arbitrary malicious commands through the ussdValue a...

PT-2026-69220

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 versions prior to 1.1.5 C1 202607071108 Description A command injection issue exists in the '/boafrm/formL2tpv3ConfigSetup' endpoint. A remote attacker can inject arbitrary malicious commands through the...

CVE-2026-71949: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in...

CVE-2026-71954: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in...

CVE-2026-71946: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

PT-2026-69213

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 versions prior to 1.1.5 C1 202607071108 Description A command injection issue exists in the '/boafrm/formTracerouteDiagnosticRun' endpoint. A remote attacker can inject arbitrary malicious commands through t...

CVE-2026-71944: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71948: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71953: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with...

CVE-2026-71947: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in...

CVE-2026-71957: Buffer Copy without Checking Size of Input

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist.name field and execute arbitrary commands by crafting a specific...

CVE-2026-71950: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the actionvalue field, resulting in command execution...

CVE-2026-71952: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution...