Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin field, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T17:16:49.250Z",
  "pubdate": "2026-08-08T17:16:49.250Z",
  "executiveSummary": "D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 suffer from a critical command injection vulnerability residing within the web management interface. Specifically, the flaw exists in the handling of input processed by the /boafrm/formWsc endpoint. A remote, unauthenticated attacker interacting with the network-exposed interface can inject arbitrary shell commands via the localPin parameter. Successful exploitation of this vulnerability results in remote code execution with absolute root privileges on the underlying operating system. This grants the adversary complete administrative control over the affected routing device, exposing the local network to severe security risks, including interception of traffic, lateral movement, and persistent device compromise.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw stemming from improper input sanitization and validation within the web application backend of the D-Link DWR-M961 router. The vulnerable component is the HTTP form handler associated with the Wi-Fi Simple Configuration (WSC) functionality, specifically exposed via the URI path /boafrm/formWsc.\nDuring normal operation, the interface processes user-supplied input submitted through HTTP requests. The specific parameter vulnerable to manipulation is the localPin field. Due to inadequate filtering, escaping, and sanitization of characters that possess special meaning to the underlying command shell (such as semicolons, pipes, backticks, or ampersands), malicious input is directly concatenated or passed unsafely into system execution routines or shell command wrappers by the device's binary application.\nThe attack flow proceeds as follows: 1) A remote attacker crafts an HTTP request targeting the /boafrm/formWsc endpoint. 2) The attacker appends shell metacharacters followed by arbitrary payload commands to the localPin parameter value. 3) The web server process parses the incoming request and passes the tainted parameter to the system shell for evaluation. 4) The operating system executes the attacker-supplied payload with full root privileges, bypassing all intended access controls.\nThe affected system comprises D-Link DWR-M961 hardware version C1 running any firmware release prior to 1.1.5_C1_202607071108. The vulnerability is accessible over the network, allowing remote attackers to trigger execution without prior authentication or privileged access credentials, depending on the exposure of the administrative or web management interface to untrusted networks."
}