CVE-2026-71951: D-Link DWR-M961 Command Injection via formIMEISetup

Executive Summary

CVE-2026-71951 is the fourth in a cluster of critical command injection vulnerabilities disclosed for the D-Link DWR-M961 mobile router (hardware version C1). Firmware versions prior to 1.1.5_C1_202607071108 are vulnerable. The affected endpoint is /boafrm/formIMEISetup, where the IMEI_value parameter is passed unsanitized to an OS-level shell call, enabling unauthenticated remote code execution.

CVSS Score: 9.8 (Critical)

The IMEI (International Mobile Equipment Identity) configuration interface is particularly sensitive: IMEI manipulation can affect how the device registers with cellular networks. Combined with command injection, this vulnerability allows an attacker to simultaneously gain root access and potentially alter the device's cellular identity.

Vulnerability Overview

Affected Devices

Technical Details

The /boafrm/formIMEISetup endpoint allows configuration of the cellular modem's IMEI value — a 15-digit identifier unique to each mobile device. Some routers expose IMEI configuration for carrier compatibility or SIM swapping scenarios. The IMEI_value POST parameter is passed through to a system call without validation, allowing shell metacharacter injection.

Exploit Chain

1. Attacker scans for exposed D-Link DWR-M961 C1 admin interface
2. POST request sent to /boafrm/formIMEISetup
3. IMEI_value field contains injected shell payload (e.g., "123456789012345;command")
4. boahttp web daemon passes value to system() call without filtering
5. Command executes as root
6. Attacker gains persistent root shell, extracts credentials, pivots to LAN

Example Payload Structure

POST /boafrm/formIMEISetup HTTP/1.1
Host: <router-ip>
Content-Type: application/x-www-form-urlencoded
 
IMEI_value=123456789012345;id>/tmp/pwned&submit=Apply

Impact Scope

The IMEI-specific risk deserves attention: an attacker who can write a valid IMEI to the device may be able to impersonate other cellular devices on the network, with implications for both carrier billing fraud and regulatory compliance.

Immediate Remediation

Step 1: Firmware Update (Primary Fix)

Update to firmware 1.1.5_C1_202607071108 or later:

1. Log in at http://192.168.0.1 (or your router's LAN IP)
2. Navigate to Maintenance > Firmware Upgrade
3. Download the patched firmware from D-Link's support portal
4. Apply the update and reboot
5. Verify new version under Status > Device Info

Step 2: Immediate Mitigations

1. DISABLE remote management (WAN access to admin panel) immediately
2. Restrict admin interface to trusted IPs via ACL
3. Change default admin credentials if still factory-set
4. Network-segment the router away from critical LAN resources
5. Consider disabling IMEI reconfiguration if the feature is unused

Step 3: Verify Modem IMEI Integrity

If you suspect the router has been accessed, verify the current IMEI has not been changed:

# If admin shell access available — query modem IMEI via AT command
# (exact command depends on modem chipset)
echo -e "AT+CGSN\r" > /dev/ttyUSB0
cat /dev/ttyUSB0

Compare the returned IMEI with the value on the device label. Any mismatch indicates potential compromise.

Detection

Broader Context: DWR-M961 C1 Command Injection Cluster

All four CVEs affect the same device family and share the same underlying vulnerability class — insufficient input sanitization in the boahttp embedded web server. The breadth of affected endpoints (diagnostic, USSD, SMS, and IMEI interfaces) suggests these interfaces were developed with no input validation policy in place.

Organizations operating these routers should treat all four CVEs as a single high-priority remediation event.

References

• NIST NVD — CVE-2026-71951
• D-Link Security Advisory