CVE-2026-71946

D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 are vulnerable to a command injection flaw that allows remote attackers to execute arbitrary commands with root privileges through the /boafrm/formPingDiagnosticRun interface. This critical vulnerability poses a significant risk to device integrity and security, making it essential for users of affected devices to prioritize immediate updates to mitigate potential exploitation. Network administrators and security teams managing these devices should act swiftly to ensure their systems are patched.