Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:48.267Z",
  "pubdate": "2026-08-08T17:16:48.267Z",
  "executiveSummary": "D-Link DWR-M961 devices running hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 are susceptible to a critical command injection vulnerability.\nThe vulnerability resides within the web administrative interface via the /boafrm/formUSSDSetup endpoint.\nAn unauthenticated or remote attacker can exploit this flaw by supplying specially crafted malicious input into the ussdValue and selectMenuValue HTTP request parameters.\nSuccessful exploitation of this vulnerability leads to arbitrary OS command execution with root privileges on the underlying operating system.\nThis introduces severe risk implications, including complete device compromise, potential lateral movement within the local network, disruption of network services, and full loss of device confidentiality, integrity, and availability.\nRemediation requires updating the affected D-Link DWR-M961 firmware to version 1.1.5_C1_202607071108 or later.",
  "technicalDetails": "The vulnerability is classified as a command injection flaw occurring within the /boafrm/formUSSDSetup interface of the web management binary.\nThe root cause stems from improper input sanitization and validation of parameters processed by the underlying application logic before passing them to system shell execution functions.\nSpecifically, the vulnerable input vectors are the ussdValue and selectMenuValue fields exposed by the USSD setup form handling mechanism.\nAttack flow begins when a remote attacker crafts an HTTP request containing shell metacharacters or command separators injected directly into the ussdValue or selectMenuValue parameters.\nUpon submission to the /boafrm/formUSSDSetup endpoint, the affected firmware processes the HTTP request and improperly concatenates or passes the raw parameter values directly into a system-level execution function, such as system() or popen(), without adequate filtering.\nBecause the web server process typically executes with elevated privileges on embedded SOHO routers, the injected commands are spawned directly with root privileges.\nNetwork exposure is inherent to management interfaces accessible over the network interface, allowing remote interaction with the HTTP server hosting the vulnerable /boafrm/formUSSDSetup handler.\nPost-exploitation impact includes persistent compromise of the routing device, interception or redirection of network traffic, modification of firewall and routing configurations, and deployment of secondary payloads or botnet binaries."
}