Description

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T18:16:56.503Z",
  "pubdate": "2026-08-08T18:16:56.503Z",
  "executiveSummary": "D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 suffer from an unauthenticated remote command injection vulnerability located within the app.cgi interface. The security flaw stems from insufficient input sanitization and validation applied to user-supplied parameters processed by the underlying system interface. Specifically, an attacker can supply malicious shell metacharacters via the netDig.ping.dst field to achieve arbitrary command execution on the target operating system. Successful exploitation of this vulnerability grants the adversary complete administrative control over the affected hardware, executing arbitrary instructions with root privileges. Given the remote accessibility of the attack vector, unauthorized external entities can compromise the confidentiality, integrity, and availability of the device and potentially pivot deeper into the connected internal network. Risk implications are critical, as total device takeover allows an attacker to intercept traffic, modify routing tables, or deploy persistent malware within the local routing infrastructure. Remediation requires applying official vendor software updates or restricting network exposure to trusted administrative interfaces.",
  "technicalDetails": "The vulnerability resides in the app.cgi interface of D-Link DWR-M961 routers, specifically targeting the netDig.ping.dst parameter handling routines. The root cause is characterized by improper input neutralization, where parameters passed from the web application interface are concatenated directly into system command execution functions without sufficient sanitization or the use of safe API wrappers.\nThe vulnerable component is the diagnostic ping functionality exposed through the web management interface. When a user or remote entity initiates a network diagnostic utility test, the input provided to the netDig.ping.dst field is processed by the backend system shell to execute standard ICMP ping operations. Because the application fails to adequately filter shell metacharacters such as semicolons, pipes, backticks, or ampersands, an attacker can append arbitrary system commands directly to the targeted input vector.\nThe attack flow proceeds as follows: First, a remote attacker crafts a specially formatted HTTP request targeting the app.cgi endpoint. Within the payload parameters, the attacker populates the netDig.ping.dst field with valid target data immediately followed by command injection sequences (e.g., shell operators and payload strings). Second, the web application parses the request and passes the unsanitized string directly to the underlying operating system shell execution routines. Third, the system executes both the intended diagnostic utility and the attacker-supplied malicious payload concurrently or sequentially.\nExploitation requires network access to the web interface exposed by the affected device. Depending on device configuration, this interface may be exposed directly to the wide area network or restricted to the local local area network. The execution context of the injected commands operates with root privileges, bypassing normal access controls and allowing total compromise of the underlying Linux-based operating system. Post-exploitation impact includes the installation of backdoors, unauthorized modification of device configurations, interception of network traffic traversing the routing device, and usage of the compromised router as a staging point for attacks against internal network hosts."
}