Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:48.570Z",
  "pubdate": "2026-08-08T17:16:48.570Z",
  "executiveSummary": "D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 are susceptible to a critical command injection vulnerability residing within the /boafrm/formIMEISetup interface. This security flaw enables a remote attacker to inject arbitrary malicious operating system commands through the vulnerable IMEI_value parameter. Successful exploitation of this vulnerability results in arbitrary command execution with elevated root privileges, posing severe risk implications to device integrity, confidentiality, and availability. The attack vector targets the web management interface, allowing unauthenticated or remotely positioned threat actors to compromise the affected routing and networking hardware entirely, bypassing standard security controls and potentially facilitating pivot attacks within the local network infrastructure.",
  "technicalDetails": "The vulnerability is caused by insufficient input sanitization and improper validation of user-supplied data passed to the underlying operating system shell within the /boafrm/formIMEISetup interface of D-Link DWR-M961 routers. Specifically, the IMEI_value field processes incoming HTTP requests and inadequately filters metacharacters or command separators before passing parameters to system execution functions.\nThe attack flow proceeds as follows: 1) A remote attacker crafts a malicious HTTP request targeting the /boafrm/formIMEISetup endpoint. 2) The attacker appends shell metacharacters followed by arbitrary payload commands within the IMEI_value parameter. 3) The target web server processes the request and hands the unsanitized string directly to the underlying system shell for execution. 4) The payload executes in the context of the root user due to the lack of privilege separation within the affected daemon or script.\nThe affected components comprise the firmware web management binaries and associated form-handling scripts for hardware version C1 prior to firmware version 1.1.5_C1_202607071108. Network exposure includes the administrative web interface, which may be accessible via the Local Area Network (LAN) or Wide Area Network (WAN) if remote management is enabled. Post-exploitation impact includes full system compromise, unauthorized access to sensitive configuration parameters, modification of device firmware, interception of network traffic, and establishment of persistent unauthorized access with root privileges."
}