CVE-2026-71950: D-Link Corporation Dwr-m961

Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days.

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.

Affected products

• D-Link Corporation Dwr-m961: before 1.1.5_C1_202607071108 (fixed in 1.1.5_C1_202607071108)

Published 2026-08-08. Last modified 2026-08-31.