CVE-2026-71951 D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71951

D-Link DWR‑M961 devices with hardware version C1 and firmware prior to 1.1.5_C1_202607071108 are affected by a remote command‑injection in the /boafrm/formIMEISetup interface. The vulnerability allows an attacker to inject commands via the IMEI_value field, resulting in command execution with roo...

EUVD-2026-54803

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71950

Affected product: D-Link DWR-M961 (hardware version C1). Vulnerable condition: firmware versions prior to 1.1.5_C1_202607071108. Root-cause: command injection in the /boafrm/formSmsManage interface allowing an attacker to inject commands via the action_value field. Impact: remote command executio...

CVE-2026-71950 D-Link DWR-M961 Command Injection via /boafrm/formSmsManage

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the actionvalue field, resulting in command execution...

EUVD-2026-54802

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the actionvalue field, resulting in command execution...

EUVD-2026-54801

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in...

CVE-2026-71949 D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in...

CVE-2026-71948

Affected product/versions: D-Link DWR-M961, hardware version C1, firmware before 1.1.5_C1_202607071108. Vulnerability: command injection via the /boafrm/formDebugDiagnosticRun interface; remote attacker can inject arbitrary commands into the host field, leading to root-level command execution. Im...

EUVD-2026-54800

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71948 D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71947 D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in...

CVE-2026-71947

CVE-2026-71947 affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. The vulnerability resides in the /boafrm/formTracerouteDiagnosticRun interface, where a remote attacker can inject commands via the host and ipVer fields, leading to command exec...

CVE-2026-71946 D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71946

D-Link DWR-M961 devices with hardware version C1 and firmware before 1.1.5_C1_202607071108 are affected by a command-injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject commands into the host field, achieving root-level command execution. Remediati...

CVE-2026-71945 D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71945

CVE-2026-71945 affects D-Link DWR-M961 devices with hardware version C1 and firmware before 1.1.5_C1_202607071108. The vulnerability is a command injection in the /boafrm/formLtefotaUpgradeFibocom interface, allowing a remote attacker to inject arbitrary commands into the fota_url field, resultin...

EUVD-2026-54797

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

EUVD-2026-54796

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71944

The CVE-2026-71944 vulnerability affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. A command-injection flaw exists in the /boafrm/formLtefotaUpgradeQuectel interface, where an attacker can inject arbitrary commands through the fota_url field, ...