Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:47.847Z",
  "pubdate": "2026-08-08T17:16:47.847Z",
  "executiveSummary": "D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 suffer from a critical command injection vulnerability. The flaw exists within the diagnostic interface, specifically targeting the ping utility endpoint. A remote, unauthenticated attacker can exploit this weakness by supplying maliciously crafted input parameters to the affected interface. Successful exploitation allows the execution of arbitrary system commands directly on the underlying host operating system. Because the affected web services operate with elevated privileges, the execution of arbitrary commands results in full root privilege compromise of the targeted networking device. The risk implications are severe, as an attacker gaining root access can achieve complete administrative control, intercept network traffic, modify system configurations, or leverage the compromised router as a pivot point for further internal network exploitation. No complex exploitation requirements are specified beyond network accessibility to the vulnerable diagnostic interface. Remediation requires updating the device firmware to version 1.1.5_C1_202607071108 or later, where the input validation flaw is addressed by the vendor.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw located within the web application component responsible for executing diagnostic utilities. Specifically, the vulnerable code path resides in the /boafrm/formPingDiagnosticRun interface. The root cause of the vulnerability stems from insufficient input sanitization and improper validation of user-supplied data accepted by the host parameter before passing it to the underlying operating system shell or system execution functions.\nDuring standard operation, the /boafrm/formPingDiagnosticRun interface accepts user input designated for network diagnostic functions like the ping utility. However, because the application fails to adequately strip or escape shell metacharacters and command separators (such as semicolons, pipe symbols, or backticks), an attacker can inject malicious shell commands directly into the host input field.\nThe attack flow proceeds as follows. First, the remote attacker establishes network connectivity to the vulnerable D-Link DWR-M961 device's administrative web interface or exposed diagnostic endpoint. Second, the attacker crafts an HTTP request targeting the /boafrm/formPingDiagnosticRun interface, appending shell command payloads to the vulnerable host parameter. Third, the backend web application processes the HTTP request and constructs a system command string incorporating the unsanitized user input. Fourth, the system passes the concatenated string to the underlying operating system shell for execution.\nBecause the web server and associated CGI binaries execute with root privileges, the injected shell commands inherit these elevated access rights. Consequently, the attacker achieves arbitrary command execution with root privileges on the host operating system. The post-exploitation impact includes full system compromise, persistence establishment, modification of firewall rules, exfiltration of sensitive configuration data, and disruption of network services. Network exposure involves remote accessibility to the HTTP/HTTPS management or diagnostic services, and exploitation does not inherently require valid user authentication based on the provided vulnerability scope."
}