CVE-2026-71949criticalCWE-78

CVE-2026-71949: falha crítica em D-Link Corporation DWR-M961

D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar DWR-M961

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 3.2%
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
D-Link Corporation · DWR-M961
CVEs relacionadas — D-Link Corporation DWR-M961

No mesmo produto, das mais perigosas para as menos.

CVE-2026-71956CRITICALD-Link DWR-M961 Command Injection via app.cgiEPSS 3.2%CVE-2026-71955CRITICALD-Link DWR-M961 Command Injection via /boafrm/formWscEPSS 3.2%CVE-2026-71954CRITICALD-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetupEPSS 3.2%CVE-2026-71953CRITICALD-Link DWR-M961 Command Injection via /boafrm/formNtpEPSS 3.2%CVE-2026-71952CRITICALD-Link DWR-M961 Command Injection via /boafrm/formPinManageSetupEPSS 3.2%CVE-2026-71951CRITICALD-Link DWR-M961 Command Injection via /boafrm/formIMEISetupEPSS 3.2%