Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:48.413Z",
  "pubdate": "2026-08-08T17:16:48.413Z",
  "executiveSummary": "D-Link DWR-M961 devices running hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 suffer from a critical command injection vulnerability.\nThe vulnerability resides in the /boafrm/formSmsManage interface, specifically within the action_value field.\nA remote, network-adjacent or remote attacker can supply crafted input containing arbitrary malicious commands, bypassing input sanitization mechanisms.\nSuccessful exploitation allows the execution of arbitrary system commands with root privileges, leading to complete device compromise.\nThis flaw represents a severe risk to network infrastructure and confidentiality, integrity, and availability, enabling persistent unauthorized control over the affected hardware.",
  "technicalDetails": "The vulnerability is classified as a command injection flaw occurring within the web management interface of the targeted routers.\nThe vulnerable component is the /boafrm/formSmsManage handler, which processes parameters submitted through the HTTP interface.\nSpecifically, the action_value parameter fails to properly validate, sanitize, or escape user-supplied input before passing it to underlying system shells or execution functions.\nAttack flow begins when an attacker crafts a malicious HTTP request directed at the /boafrm/formSmsManage endpoint.\nThe payload is injected directly into the action_value field, often utilizing shell metacharacters such as semicolons, pipes, or backticks to chain arbitrary system commands.\nUpon processing the request, the web application backend passes the unsanitized string to the underlying operating system shell.\nBecause the web server and associated CGI binaries typically operate with elevated permissions, the injected payload executes with root privileges.\nAffected systems include D-Link DWR-M961 hardware version C1 with firmware versions prior to 1.1.5_C1_202607071108.\nPost-exploitation impact includes full system compromise, potential lateral movement into connected internal networks, data interception, modification of device configurations, and installation of persistent backdoors."
}