Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:49.097Z",
  "pubdate": "2026-08-08T17:16:49.097Z",
  "executiveSummary": "D-Link DWR-M961 devices running hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 suffer from a critical command injection vulnerability.\nThe vulnerability resides in the /boafrm/formL2tpv3ConfigSetup interface, allowing remote unauthenticated or remote attackers to execute arbitrary system commands.\nSuccessful exploitation results in complete system compromise with root privileges, posing severe risks to network integrity, confidentiality, and availability.\nAttackers can leverage this flaw by injecting malicious command payloads directly into the tunnelid and sessionid parameters.\nThe inherent network exposure of router management interfaces combined with root-level code execution makes this vulnerability a critical vector for perimeter breach and subsequent lateral movement.",
  "technicalDetails": "The vulnerability is classified as a command injection flaw occurring within the /boafrm/formL2tpv3ConfigSetup interface of the targeted D-Link DWR-M961 devices.\nThe root cause stems from insufficient input sanitization and validation procedures applied to user-supplied parameters before passing them to underlying system shells or operating system execution functions.\nSpecifically, the vulnerable input vectors are the tunnelid and sessionid fields exposed via the L2TPv3 configuration setup form.\nThe attack flow proceeds as follows: a remote attacker crafts a malicious HTTP request directed at the /boafrm/formL2tpv3ConfigSetup endpoint.\nWithin this request, the attacker embeds shell metacharacters or command separators (such as semicolons, pipe symbols, or backticks) combined with arbitrary system commands into the tunnelid or sessionid parameters.\nUpon receiving the request, the application processes the input and insecurely concatenates or passes the unsanitized string to the underlying operating system interpreter.\nBecause the web server or underlying daemon executes with elevated privileges, the injected commands are executed directly with root privileges.\nAffected products include D-Link DWR-M961 hardware version C1 with firmware versions older than 1.1.5_C1_202607071108.\nThe post-exploitation impact includes full administrative control over the affected device, enabling attackers to modify routing tables, intercept network traffic, install persistent backdoors, and pivot into internal network segments."
}