D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Quectel)

Executive Summary

A command injection vulnerability has been identified in D-Link DWR-M961 LTE routers running hardware version C1 with firmware prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formLtefotaUpgradeQuectel interface and allows a remote attacker to inject arbitrary OS commands through the fota_url parameter, achieving unauthenticated remote code execution on the device.

CVE ID: CVE-2026-71944

Vulnerability Overview

The D-Link DWR-M961 is a consumer-grade LTE router that supports over-the-air (OTA) firmware updates for its modem module. The formLtefotaUpgradeQuectel endpoint — responsible for triggering FOTA (Firmware Over The Air) upgrades for the Quectel modem chipset — fails to sanitize the fota_url field before passing it to an underlying OS command.

Technical Details

Root Cause

The BoA-based web server on the DWR-M961 exposes FOTA management endpoints for the device's internal modem module. The Quectel FOTA upgrade handler (formLtefotaUpgradeQuectel) accepts a URL parameter (fota_url) specifying the location of a firmware image. This value is passed directly to an OS-level command — likely via system() or popen() — without any input validation or sanitization.

An attacker with network access to the device's administration interface (typically LAN-side, but potentially WAN-exposed on misconfigured or ISP-provisioned deployments) can craft a malicious POST request to inject shell metacharacters alongside a command payload.

Exploit Pattern

POST /boafrm/formLtefotaUpgradeQuectel HTTP/1.1
Host: <router-ip>
Content-Type: application/x-www-form-urlencoded
 
fota_url=http://example.com/fw.bin;id;

The injected command (e.g., id, wget, busybox) executes with the privileges of the BoA web server process — typically root on embedded Linux routers.

Affected Products

Note: Other hardware revisions of the DWR-M961 may use different firmware branches and should be evaluated independently.

Related CVEs in the Same Device

The DWR-M961 (Hardware C1) was found to contain multiple command injection vulnerabilities across different diagnostic and management interfaces, all addressed in the same firmware release:

The breadth of these findings suggests a systemic lack of input validation in the device's BoA-based web management framework.

Remediation

Immediate Action

Update firmware to version 1.1.5_C1_202607071108 or later.

1. Log in to the DWR-M961 web administration interface
2. Navigate to Maintenance → Firmware Update
3. Check for and apply available firmware updates
4. Alternatively, download the patched firmware from D-Link's official support portal

If Patching Is Not Immediately Possible

• Restrict access to the device's web management interface (disable WAN-side admin access)
• Enable firewall rules to block external access to the BoA web server (default port 80/8080)
• Place the device behind a network firewall that blocks access to router management ports from untrusted networks
• Monitor for anomalous outbound connections from the router that may indicate exploitation

Risk Assessment

Consumer LTE routers like the DWR-M961 are commonly deployed in small offices, retail locations, and residential environments. Many are managed by ISPs with remote management enabled, increasing their potential attack surface. Command injection on a router provides an attacker with:

• Full network visibility — traffic interception, DNS manipulation, MITM capability
• Persistent access — firmware persistence or cron-based backdoors
• Lateral movement — router as a pivot point into LAN-connected devices
• Botnet recruitment — the device becomes a node in DDoS infrastructure

References

• NVD — CVE-2026-71944
• D-Link Support — DWR-M961 Firmware Downloads