CVE-2026-71956

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 are vulnerable to a command injection flaw in the app.cgi interface, allowing remote attackers to execute arbitrary commands with root privileges. This critical vulnerability poses a significant risk to the integrity and security of affected devices, making it essential for organizations using these models to prioritize immediate remediation. Users should update their devices to the latest firmware to mitigate potential exploitation.