Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:48.890Z",
  "pubdate": "2026-08-08T17:16:48.890Z",
  "executiveSummary": "D-Link DWR-M961 devices running hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 suffer from a critical command injection vulnerability.\nThe vulnerability resides in the network time protocol configuration interface, specifically within the /boafrm/formNtp endpoint.\nA remote attacker with network access to the vulnerable interface can inject arbitrary malicious commands via the ntpServerIp1 parameter.\nSuccessful exploitation of this flaw leads to remote code execution with root privileges, entirely compromising the confidentiality, integrity, and availability of the affected device.\nThe high risk is compounded by the execution context, allowing full administrative control over the underlying operating system.\nExploitation requirements include network connectivity to the management interface and the ability to interact with the HTTP form handler.",
  "technicalDetails": "The vulnerability is caused by improper neutralization of user-supplied input passed to the system shell within the Network Time Protocol configuration handler.\nThe vulnerable component is the /boafrm/formNtp interface, which processes input parameters submitted by clients.\nSpecifically, the ntpServerIp1 field fails to adequately sanitize or validate input strings before passing them to underlying system functions or shell interpreters.\nThe attack flow proceeds as follows: an authenticated or unauthenticated remote attacker crafts an HTTP request targeting the /boafrm/formNtp endpoint.\nThe attacker appends shell metacharacters and arbitrary commands to the ntpServerIp1 parameter value.\nUpon receiving the HTTP request, the web server daemon parses the form data and improperly concatenates the malicious payload into a system command execution routine.\nBecause the web server or underlying daemon executes with root privileges, the injected commands are executed directly by the operating system shell with maximum privileges.\nThis behavior results in arbitrary command execution, enabling the attacker to establish persistent access, modify device configurations, manipulate network traffic, or pivot further into the internal network.\nThe affected product is the D-Link DWR-M961 with hardware version C1, encompassing all firmware versions prior to 1.1.5_C1_202607071108."
}