CVE-2026-71948: D-Link DWR-M961 Command Injection via formDebugDiagnosticRun

Executive Summary

A critical command injection vulnerability (CVE-2026-71948) has been disclosed in D-Link DWR-M961 mobile Wi-Fi routers running hardware version C1 with firmware prior to 1.1.5_C1_202607071108. The flaw resides in the /boafrm/formDebugDiagnosticRun web interface, where a remote unauthenticated attacker can inject arbitrary OS commands through the host parameter.

CVSS Score: 9.8 (Critical)

This is one of four command injection CVEs (CVE-2026-71948 through CVE-2026-71951) affecting the same device across different web management interfaces, all with identical CVSS severity. Firmware update to version 1.1.5_C1_202607071108 or later is the only remediation.

Vulnerability Overview

Affected Devices

Technical Details

The /boafrm/formDebugDiagnosticRun endpoint is part of the router's diagnostic toolset, typically used for ping/traceroute-style debug operations. The web management service fails to sanitize the host field before passing it to a system shell call, enabling classic command injection via shell metacharacters (;, &&, |, `).

Exploit Chain

1. Attacker identifies D-Link DWR-M961 C1 router exposed to network
2. Attacker sends crafted POST request to /boafrm/formDebugDiagnosticRun
3. Payload in "host" field contains injected OS commands
4. Router's web service passes unsanitized input to system() or popen()
5. Commands execute as root (typical embedded router web daemon)
6. Attacker achieves full device control — credential theft, backdoor, pivot

Example Payload Structure

POST /boafrm/formDebugDiagnosticRun HTTP/1.1
Host: <router-ip>
Content-Type: application/x-www-form-urlencoded
 
host=8.8.8.8;id;whoami&action=ping

Impact Scope

Immediate Remediation

Step 1: Update Firmware

Download and apply firmware version 1.1.5_C1_202607071108 or later from the D-Link support portal.

1. Log in to the router admin panel (default: http://192.168.0.1)
2. Navigate to Maintenance > Firmware Upgrade
3. Upload the downloaded firmware file
4. Wait for the router to reboot and verify the version

Step 2: Restrict Management Interface Access

If firmware update cannot be applied immediately:

1. Disable remote management (WAN-side access to admin panel)
2. Apply ACLs to permit only trusted management IPs
3. Place the device behind a stateful firewall
4. Consider disabling the debug diagnostic interface if accessible separately

Step 3: Verify No Existing Compromise

# If you have shell access to the device, check for unexpected processes
ps aux | grep -v '\[' | grep -v 'grep'
 
# Review recently modified files
find / -newer /etc/passwd -type f 2>/dev/null
 
# Check crontab for persistence
crontab -l

Detection

Network Exposure

D-Link mobile routers are commonly deployed in SOHO, retail, and IoT environments. Devices directly exposed to the internet with management interfaces accessible on the WAN side are at highest risk. Shodan and similar search engines may index thousands of exposed instances.

Remediation Checklist

1. Verify hardware revision — check the label on the device for "Ver. C1"
2. Check current firmware — Admin panel > Status > Device Info
3. Download patched firmware from D-Link support
4. Apply update and verify version after reboot
5. Disable WAN management if not required
6. Change default credentials if still at factory defaults
7. Monitor logs for suspicious POST requests to boafrm endpoints
8. Segment IoT devices onto a separate VLAN

Related CVEs in This Advisory Series

This vulnerability is part of a cluster of four command injection flaws disclosed simultaneously for the DWR-M961 C1:

References

• NIST NVD — CVE-2026-71948
• D-Link Security Advisory