CVE-2026-71944

D-Link DWR-M961 devices with hardware version C1 and firmware prior to 1.1.5_C1_202607071108 are vulnerable to a command injection flaw that allows remote attackers to execute arbitrary commands with root privileges via the fota_url field in the /boafrm/formLtefotaUpgradeQuectel interface. This critical vulnerability poses a significant risk to device integrity and security, making it essential for users of affected devices to prioritize immediate updates to mitigate potential exploitation. Organizations relying on these devices should take urgent action to secure their systems against this threat.