CVE-2026-71949 D‑Link CVE debrief

Who should care

Administrators and users of D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 should be aware of this critical vulnerability and take immediate action to patch affected devices. Additionally, security teams and vulnerability management teams should prioritize patching and monitor for suspicious activity on affected devices.

Technical summary

CVE-2026-71949 is a critical command injection vulnerability in the /boafrm/formUSSDSetup interface of D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges. The vulnerability has a CVSS score of 9.3 and is considered critical. It is essential to patch affected devices immediately and implement additional security measures to prevent exploitation.

Defensive priority

Administrators should prioritize patching D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 due to a critical command injection vulnerability.

Recommended defensive actions

• Apply firmware updates to D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108.
• Restrict access to the /boafrm/formUSSDSetup interface.
• Monitor for suspicious activity on affected devices.
• Verify device configurations for potential compromise.
• Conduct a thorough review of network configurations to ensure that affected devices are isolated.
• Implement additional security measures such as intrusion detection systems.
• Perform regular security audits to identify and address potential vulnerabilities.

Evidence notes

The CVE-2026-71949 record indicates a critical command injection vulnerability in D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108. Evidence is based on official CVE and NVD records, as well as references from D-Link and VulnCheck. However, details about affected scope and vendor remediation efforts are limited. Further verification is needed to confirm the extent of the vulnerability and to ensure that patches have been applied. Defensive measures should include reviewing device configurations for potential compromise and monitoring for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.