CVE-2026-71946 D-Link Corporation CVE debrief

Who should care

Administrators and security teams responsible for D-Link DWR-M961 devices, particularly those with hardware version C1 and firmware version before 1.1.5_C1_202607071108, should be aware of this critical vulnerability and take immediate action to patch affected devices. This includes reviewing current deployments, assessing potential exposure, and prioritizing patching efforts based on risk and asset criticality. Additionally, security teams should monitor for suspicious activity on affected devices and review logs for potential exploitation attempts.

Technical summary

CVE-2026-71946 is a critical command injection vulnerability in D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108. The vulnerability exists in the /boafrm/formPingDiagnosticRun interface, allowing remote attackers to inject arbitrary malicious commands into the host field, resulting in command execution with root privileges. This vulnerability has a CVSS score of 9.3 and is classified as CRITICAL.

Defensive priority

Administrators should prioritize patching D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 due to a critical command injection vulnerability.

Recommended defensive actions

• Apply firmware updates to D-Link DWR-M961 devices with hardware version C1 to version 1.1.5_C1_202607071108 or later
• Restrict access to the /boafrm/formPingDiagnosticRun interface
• Monitor for suspicious activity on affected devices
• Inventory affected devices for prioritized patching
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-71946 record indicates a critical command injection vulnerability in D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108. Evidence is based on official CVE and NVD records, as well as references from D-Link and VulnCheck. However, details about the vendor's response and affected scope are limited. Further verification is needed to confirm affected deployments and assess potential impact.

Official resources