AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-71950

CRITICAL · CVSS 9.8 EPSS 2.09%

Source: NVD + CISA KEV + EPSS · Published 2026-08-08 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

D-Link DWR-M961 devices with hardware version C1 running firmware prior to 1.1.5_C1_202607071108 are vulnerable to a command injection flaw in the /boafrm/formSmsManage interface. This vulnerability allows remote attackers to execute arbitrary commands with root privileges, potentially compromising the device and the network it is connected to. Organizations using these devices should prioritize patching to mitigate the risk of unauthorized access and control.

CVE
CVE-2026-71950
Severity
CRITICAL
CVSS
9.8
EPSS
2.09%

Original NVD Description

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.