Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:47.550Z",
  "pubdate": "2026-08-08T17:16:47.550Z",
  "executiveSummary": "D-Link DWR-M961 routers running hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 suffer from a critical OS command injection vulnerability. This security defect exists within the device management web interface, specifically targeting the /boafrm/formLtefotaUpgradeQuectel endpoint via the vulnerable fota_url field.\nSuccessful exploitation of this vulnerability allows a remote attacker to execute arbitrary shell commands on the underlying operating system. Because the affected web services operate with elevated privileges, any injected command is executed directly with root privileges, leading to complete device compromise.\nThe attack vector requires network access to the vulnerable interface, though specific authentication requirements are not detailed in the baseline disclosure. The impact of successful exploitation is severe, as it enables unauthorized actors to intercept traffic, modify device configurations, pivot into internal networks, or render the hardware inoperable.\nRisk implications are exceptionally high for enterprise and consumer environments deploying affected D-Link DWR-M961 units. Immediate patching to firmware version 1.1.5_C1_202607071108 or later is required to eliminate the underlying flaw.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located in the firmware upgrade handling mechanism of D-Link DWR-M961 devices. The vulnerable component is exposed via the web server interface at the /boafrm/formLtefotaUpgradeQuectel endpoint, which processes firmware over-the-air upgrade parameters supplied by users.\nThe root cause of the vulnerability stems from insufficient input sanitization and improper validation of user-supplied parameters within the request handling logic. Specifically, the fota_url field accepts arbitrary strings without adequately stripping or escaping shell metacharacters before passing the input to system-level execution functions or shell interpreters.\nThe step-by-step attack flow begins with a remote attacker crafting a malicious HTTP request directed at the /boafrm/formLtefotaUpgradeQuectel URL path. Within this request, the attacker populates the fota_url parameter with a payload containing shell command separators (such as semicolons, pipes, or backticks) followed by arbitrary operating system commands.\nUpon receiving the request, the vulnerable web application component parses the parameter and concatenates or passes the unsanitized string into a system execution call. Because the firmware services run with maximum privileges, the operating system executes the embedded shell commands as the root user.\nAffected systems include D-Link DWR-M961 devices with hardware version C1 and firmware versions before 1.1.5_C1_202607071108. The network exposure is determined by the accessibility of the administrative web interface, which may be reachable via the local area network or improperly exposed to the wide area network.\nPost-exploitation impact includes full root-level control over the D-Link DWR-M961 router. Attackers can establish persistent backdoors, modify routing tables, execute man-in-the-middle attacks, capture sensitive network traffic, or utilize the compromised edge device as a staging point for attacks against internal network resources."
}