D-Link DWR-M961 command injection vulnerability (CNVD-2026-32363)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability, which stems from the /boafrm/formPinManager interface not filtering the...

CVE-2026-71952

D-Link DWR-M961 devices with hardware version C1 and firmware before 1.1.5_C1_202607071108 are vulnerable to a command injection via the /boafrm/formPinManageSetup interface. An attacker can inject commands into the oldPIN field, causing root-level execution. Remediation: upgrade to firmware 1.1....

CVE-2026-71952

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution...

CVE-2026-71952: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution...