CVE-2026-71950

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 versions prior to 1.1.5 C1 202607071108

Description A command injection issue exists in the '/boafrm/formSmsManage' endpoint. A remote attacker can inject arbitrary malicious commands through the action value field, allowing for command execution with root privileges.

Recommendations Update D-Link DWR-M961 hardware version C1 to firmware version 1.1.5 C1 202607071108 or later. Restrict access to the '/boafrm/formSmsManage' interface to minimize the risk of exploitation.