CVE-2026-71955

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 versions prior to 1.1.5 C1 202607071108

Description A command injection issue exists in the '/boafrm/formWsc' endpoint. A remote attacker can execute arbitrary malicious commands with root privileges by injecting them into the localPin, targetAPSsid, peerPin, and peerRptPin fields. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the host machine via a vulnerable application.

Recommendations Update D-Link DWR-M961 to version 1.1.5 C1 202607071108 or later. Restrict access to the '/boafrm/formWsc' endpoint to minimize the risk of exploitation.