CVE-2026-71949: D-Link DWR-M961 Command Injection via formUSSDSetup

Executive Summary

CVE-2026-71949 is a critical command injection vulnerability in D-Link DWR-M961 routers (hardware version C1) with firmware prior to 1.1.5_C1_202607071108. The flaw is located in the /boafrm/formUSSDSetup interface, where the ussdValue and selectMenuValue parameters accept unsanitized input that is passed directly to the underlying OS shell.

CVSS Score: 9.8 (Critical)

This is the second of four command injection CVEs (CVE-2026-71948 to CVE-2026-71951) disclosed simultaneously for the same router model. All exploit the same root cause — missing input sanitization in the router's boahttp web daemon — across different functional interfaces. Firmware version 1.1.5_C1_202607071108 patches all four.

Vulnerability Overview

Affected Devices

Technical Details

The /boafrm/formUSSDSetup endpoint manages USSD (Unstructured Supplementary Service Data) configuration for the router's integrated cellular modem. USSD is the GSM protocol used for mobile operator service codes (e.g., *100# for balance checks). The router accepts USSD string values via a web form and passes them to the modem subsystem without validation.

By injecting shell metacharacters into the ussdValue or selectMenuValue fields, an attacker can escape the intended command context and execute arbitrary OS commands with the privileges of the web daemon (typically root on embedded devices).

Exploit Chain

1. Attacker identifies DWR-M961 C1 with management interface reachable
2. Crafted POST sent to /boafrm/formUSSDSetup
3. ussdValue or selectMenuValue contains injected shell commands
4. boahttp web daemon passes value to system() without sanitization
5. Commands execute — full device control achieved
6. Attacker may additionally abuse USSD stack for SIM-based attacks

Example Payload Structure

POST /boafrm/formUSSDSetup HTTP/1.1
Host: <router-ip>
Content-Type: application/x-www-form-urlencoded
 
ussdValue=*100%23;cat+/etc/passwd&selectMenuValue=1

Impact Scope

Immediate Remediation

Step 1: Apply Firmware Update

Update to 1.1.5_C1_202607071108 or later:

1. Log in to the admin interface (typically http://192.168.0.1)
2. Go to Maintenance > Firmware Upgrade
3. Upload and apply the firmware from D-Link's support portal
4. After reboot, confirm the version under Status > Device Info

Step 2: Restrict Management Access

1. Confirm WAN-side management is disabled (Settings > Remote Management)
2. Restrict admin panel access to trusted LAN IPs only
3. Change default admin credentials immediately if not already done
4. Disable USSD configuration if cellular USSD features are not in use

Step 3: Check for Compromise Indicators

# List running processes on device (if shell access available)
ps
 
# Check for unrecognized listening ports
netstat -tlnp
 
# Review iptables for unexpected rules
iptables -L -n -v

Detection

Related CVEs in This Advisory Series

References

• NIST NVD — CVE-2026-71949
• D-Link Security Advisory