DWR-M961 (Hardware Version C1, Software Version 1.1.2_C1_202602110044) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/dwr-m961-hardware-version-c1-software-version-1.1.2_c1_202602110044/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 08 Aug 2026 17:40:26 +0000Remote Command Injection in D-Link DWR-M961https://feed.craftedsignal.io/briefs/2026-08-dlink-command-injection/Sat, 08 Aug 2026 17:40:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-dlink-command-injection/D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 are vulnerable to unauthenticated command injection via the fota_url parameter.D-Link DWR-M961 routers, specifically hardware version C1, contain a critical command injection vulnerability identified as CVE-2026-71944. The vulnerability exists within the firmware upgrade interface located at /boafrm/formLtefotaUpgradeQuectel. An unauthenticated remote attacker can exploit this flaw by sending a crafted HTTP request containing malicious commands in the fota_url parameter. Successful exploitation allows the attacker to execute arbitrary code with root privileges on the affected device, potentially leading to a complete compromise of the router. This vulnerability highlights the risks associated with improper input validation in router administrative interfaces. Defenders should prioritize patching, as this device class is a common target for botnet recruitment and persistent unauthorized access.

Impact

The vulnerability carries a CVSS 3.1 base score of 9.8, indicating high severity and ease of exploitation. An attacker who successfully triggers this vulnerability gains full administrative control over the DWR-M961 device. Potential impacts include device bricking, participation in DDoS botnets, man-in-the-middle attacks on local network traffic, and establishment of persistent backdoors within the organization's network perimeter.

Recommendation

Prioritize updating the firmware of all D-Link DWR-M961 (C1 hardware) devices to version 1.1.5_C1_202607071108 or later immediately. Ensure these devices are not exposed to the public internet by placing them behind a firewall or using a VPN for remote management.

]]>criticaladvisoryvulnerabilityremote-code-executionnetwork-security