Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:47.710Z",
  "pubdate": "2026-08-08T17:16:47.710Z",
  "executiveSummary": "D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 suffer from an unauthenticated remote command injection vulnerability.\nThe flaw resides within the /boafrm/formLtefotaUpgradeFibocom interface, specifically via improper neutralization of user-supplied input passed to the fota_url parameter.\nA remote, unauthenticated attacker can exploit this weakness by submitting crafted HTTP requests containing malicious shell metacharacters.\nSuccessful exploitation results in arbitrary command execution directly on the underlying operating system with root privileges, granting the adversary complete compromise of the affected routing hardware.\nThis introduces severe risk implications, including persistent device hijacking, lateral movement into internal local area networks, traffic interception, and disruption of critical communication infrastructure.\nMitigation requires upgrading the affected firmware to version 1.1.5_C1_202607071108 or later, restricting network access to the administrative and management interfaces, and disabling remote management services where feasible.",
  "technicalDetails": "The vulnerability is classified as a remote command injection flaw originating from insufficient input sanitization and validation within the web application interface handling firmware over-the-air (FOTA) updates.\nThe vulnerable component is the binary handling requests sent to the /boafrm/formLtefotaUpgradeFibocom endpoint, which processes parameters submitted through web forms.\nSpecifically, the fota_url field accepts Uniform Resource Locator inputs intended for retrieving firmware upgrade packages but fails to adequately filter shell metacharacters before passing the input to system execution routines or shell interpreters.\nThe attack vector is network-exposed, allowing remote threat actors reachable via the web interface to interact with the device over HTTP or HTTPS.\nThe exploitation method involves an attacker crafting an HTTP request directed at /boafrm/formLtefotaUpgradeFibocom where the fota_url parameter is appended with malicious command sequences, such as pipe symbols, backticks, or semicolons followed by arbitrary system commands.\nThe attack flow proceeds as follows: 1) The attacker identifies the exposed management or web interface running the vulnerable Boa-based or embedded web server. 2) The attacker constructs a malicious HTTP POST or GET request targeting the /boafrm/formLtefotaUpgradeFibocom interface. 3) The fota_url variable is populated with a payload containing the target URL combined with command injection syntax. 4) The web application backend processes the request and improperly passes the unsanitized fota_url value to a system-level execution function, such as popen() or system(). 5) The underlying operating system evaluates the injected shell metacharacters and executes the attacker's payload.\nBecause the web server and its underlying background processes execute with the highest level of system privileges on embedded devices of this class, the injected commands execute with root privileges.\nPost-exploitation impact includes full system compromise, installation of persistent backdoors, modification of device configuration parameters, redirection of network traffic, and potential utilization of the compromised router as a pivot point for launching further attacks against internal network segments."
}