Command Injection in D-Link DWR-M961 app.cgi netDig.ping.dst

Successful exploitation allows a remote unauthenticated attacker to achieve arbitrary command execution as root on the affected router. This can lead to full device compromise, modification of router configuration, installation of persistent backdoors, interception or manipulation of network traffic, use of the device as a pivot for further network intrusion, and complete compromise of confidentiality, integrity, and availability of the device and traffic traversing it.

If immediate patching is not possible, restrict router management access to trusted administrative networks only and block external access to the web management interface, including common HTTP and HTTPS exposure. Reduce attack surface by disabling unnecessary remote administration paths, placing management interfaces behind network access controls, and continuously monitoring for unauthorized configuration changes or signs of device compromise. Because exploitation yields root-level execution, devices suspected of compromise should be rebuilt or re-flashed with trusted firmware and have credentials rotated.

Upgrade affected D-Link DWR-M961 hardware revision C1 devices to firmware version 1.1.5_C1_202607071108 or later, which is identified as the vendor-fixed release for this vulnerability set. Verify the hardware revision before applying firmware and ensure the update is obtained through official vendor support channels.