Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:48.733Z",
  "pubdate": "2026-08-08T17:16:48.733Z",
  "executiveSummary": "D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 suffer from a critical remote command injection vulnerability. The flaw resides within the /boafrm/formPinManageSetup interface, specifically failing to properly sanitize user-supplied input submitted to the oldPIn field.\nSuccessful exploitation of this vulnerability enables a remote attacker to inject and execute arbitrary malicious operating system commands directly on the underlying host operating system. Because system services typically operate with elevated privileges, the execution of arbitrary commands results in full system compromise with root privileges.\nThis vulnerability significantly impacts the confidentiality, integrity, and availability of the affected routing and networking hardware. The security implications are severe, as unauthorized attackers can achieve persistent backdoor access, manipulate network traffic configurations, and compromise connected local area network segments.\nThe attack vector is remotely accessible over the network interface exposed by the device. To achieve successful exploitation, an attacker must interact with the vulnerable /boafrm/formPinManageSetup endpoint by supplying a crafted payload within the designated oldPIn parameter, bypassing standard input validation controls implemented by the embedded web application.",
  "technicalDetails": "The vulnerability is classified as a remote command injection flaw impacting D-Link DWR-M961 devices running hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. The vulnerable component is the web management interface managed by the BOA web server implementation, specifically processing requests routed to the /boafrm/formPinManageSetup script or handler function.\nThe root cause of the vulnerability is the unsafe handling and processing of parameter data associated with the oldPIn field. When a request is processed by the /boafrm/formPinManageSetup interface, the application improperly validates, sanitizes, or escapes input strings before passing them to underlying system execution routines, such as system() or popen() API calls.\nThe step-by-step attack flow involves an unauthenticated or remote attacker crafting an HTTP request directed at the /boafrm/formPinManageSetup endpoint. Within this request, the attacker appends shell metacharacters or command separators (such as semicolons, pipe symbols, or backticks) followed by arbitrary malicious commands into the oldPIn parameter value.\nUpon receiving the payload, the vulnerable firmware parses the HTTP POST or GET parameters and concatenates the unsanitized oldPIn input directly into a system shell command string. The operating system subsequently executes the concatenated command string with root privileges, granting the attacker complete administrative control over the affected D-Link DWR-M961 device.\nNetwork exposure is defined by the accessibility of the device management interface, which may be exposed to the local network or potentially the wider internet if WAN management features are misconfigured. Post-exploitation impact includes complete takeover of the routing device, enabling man-in-the-middle attacks, traffic sniffing, internal network reconnaissance, and the installation of persistent rootkits."
}