Loading story…
D-Link DWR-M961 routers, hardware version C1, were found to contain five critical vulnerabilities that allow remote, unauthenticated attackers to execute arbitrary commands as root or crash the device. The issues affect firmware versions earlier than 1.1.5_C1_202607071108 and include three command injection flaws—CVE-2026-71944 in /boafrm/formLtefotaUpgradeQuectel via fota_url, CVE-2026-71955 in /boafrm/formWsc via fields including localPin, targetAPSsid, peerPin, and peerRptPin, and CVE-2026-71956 in app.cgi via netDig.ping.dst—as well as two buffer overflows: CVE-2026-71957 in app.cgi via netAcc.addlist[].name and CVE-2026-71958 in quicksetup.cgi via test4, ssid2, and username.
All five bugs carry a CVSS 3.1 score of 9.8 and were classified under CWE-78 for command injection or CWE-120 for buffer overflow, reflecting high impact on confidentiality, integrity, and availability. Public reporting credited researchers Jincheng Wang, Le Yu, and Xiapu Luo with the discoveries, while D-Link released firmware 1.1.5_C1_202607071108 to address the flaws. Reporting at the time of disclosure said no active exploitation had been observed, and the vulnerabilities were also highlighted by regional CERT reporting on D-Link products.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
A ThreatAft article published on August 9, 2026 summarized five critical D-Link DWR-M961 vulnerabilities, credited their discovery to Jincheng Wang, Le Yu, and Xiapu Luo, and stated that no active exploitation had been reported at the time of publication. The report grouped CVE-2026-71944, CVE-2026-71955, CVE-2026-71956, CVE-2026-71957, and CVE-2026-71958 as a coordinated disclosure affecting firmware prior to 1.1.5_C1_202607071108.
On August 8, 2026, CVE-2026-71955 was newly received for a command injection flaw in /boafrm/formWsc on D-Link DWR-M961 C1 devices. The CVE record was also modified that day to expand the affected version range and broaden the injectable fields from a narrower description to include localPin, targetAPSsid, peerPin, and peerRptPin.
On August 8, 2026, CVE-2026-71958 was disclosed for a buffer overflow in quicksetup.cgi on D-Link DWR-M961 C1 devices. Remote unauthenticated attackers can use overly long values in test4, ssid2, or username to execute commands or crash the router.
On August 8, 2026, CVE-2026-71957 was received for a buffer overflow in app.cgi affecting D-Link DWR-M961 C1 devices. An attacker can send an overly long value to netAcc.addlist[].name to achieve command execution or crash the device.
On August 8, 2026, CVE-2026-71956 was newly received for a command injection vulnerability in the DWR-M961 app.cgi interface. The flaw lets remote attackers inject commands through the netDig.ping.dst field and execute them with root privileges.
On August 8, 2026, CVE-2026-71944 was newly received for a command injection flaw in /boafrm/formLtefotaUpgradeQuectel on D-Link DWR-M961 C1 devices. The issue allows remote attackers to inject commands via the fota_url field and gain root-level execution.
D-Link released firmware version 1.1.5_C1_202607071108 as the fix for multiple critical vulnerabilities affecting DWR-M961 hardware version C1. The vulnerable range is described as versions earlier than this firmware release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cert.gov.py
Open sourcethreataft.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-7288** and **CVE-2026-7289**, were disclosed in **D-Link DIR-825M** firmware **1.1.12**, exposing the router to remotely exploitable buffer overflows. The flaws affect the `/boafrm/formVpnConfigSetup` and `/boafrm/formWanConfigSetup` components, where improper handling of the `submit-url` argument in functions `sub_4151FC` and `sub_414BA8` can trigger memory corruption. Both CVEs were classified under **CWE-119** and **CWE-120** and were assigned high-impact ratings across confidentiality, integrity, and availability. Public exploit information is already available, and one entry notes exploitation is possible with low attack complexity and low privileges, raising the risk of real-world abuse against exposed or improperly managed devices.
Jun 29, 2026
A critical command injection vulnerability, tracked as CVE-2026-0625, has been discovered in multiple legacy D-Link DSL gateway routers. The flaw resides in the `dnscfg.cgi` endpoint, where improper input sanitization allows unauthenticated remote attackers to execute arbitrary shell commands via DNS configuration parameters. Security researchers from VulnCheck and The Shadowserver Foundation have confirmed active exploitation attempts, with evidence captured on honeypots and reports of ongoing campaigns targeting affected devices. The impacted models include DSL-526B (≤ 2.01), DSL-2640B (≤ 1.07), DSL-2740R (< 1.17), and DSL-2780B (≤ 1.01.14), all of which have reached end-of-life and will not receive security updates. D-Link has acknowledged the vulnerability and is working to determine if additional products are affected, citing challenges in identifying all impacted models due to firmware variations. The company strongly advises users to retire and replace vulnerable devices, as no patches will be issued. The vulnerability is rated as critical (CVSS 9.3), and exploitation has been observed in the wild, though the specific threat actors and targets remain unclear. The risk is heightened by the unauthenticated nature of the exploit and the widespread use of these legacy routers in consumer environments.
Jun 29, 2026
High-severity vulnerabilities have been disclosed in two consumer router lines, enabling remote operating system command injection through web-facing configuration functions. **CVE-2026-4558** affects the **Linksys MR9600** running firmware `2.0.6.206937`, where the `smartConnectConfigure` function in `SmartConnect.lua` can be abused by manipulating `configApSsid`, `configApPassphrase`, `srpLogin`, or `srpPassword`. The flaw is classified under `CWE-78` and `CWE-77`, carries high impact to confidentiality, integrity, and availability, and the disclosure says a public exploit exists and may already be used in the wild. The report also states that Linksys was contacted before publication but did not respond. A separate issue, **CVE-2026-4611**, affects **TOTOLINK X6000R** devices on firmware `9.4.0cu.1360_B20241207` and `9.4.0cu.1498_B20250826`. In that case, the `setLanCfg` function within `/usr/sbin/shttpd` allows remote command injection via the `Hostname` argument, creating a path to privilege escalation and full device compromise. Like the Linksys flaw, the TOTOLINK bug is mapped to `CWE-78` and `CWE-77` and is rated high severity across published scoring, underscoring continued risk from insecure input handling in router administration components.
Jun 29, 2026