CVE-2026-1596 is a command injection vulnerability identified in the D-Link DWR-M961 router, specifically in firmware version 1.1.47. The vulnerability resides in the function sub_419920 within the /boafrm/formLtefotaUpgradeQuectel endpoint, which processes the fota_url parameter. Improper sanitization or validation of this parameter allows an attacker to inject arbitrary system commands remotely. Since the vulnerability is remotely exploitable without user interaction and requires low privileges, it poses a significant risk. The CVSS 4.0 base score is 5.3 (medium), reflecting the moderate impact on confidentiality, integrity, and availability, and the ease of exploitation. The vulnerability could be leveraged to execute malicious commands on the device, potentially leading to unauthorized control, data leakage, or disruption of network services. Although no active exploitation has been reported, the availability of a public exploit increases the likelihood of attacks. The affected device is commonly used in consumer and small business environments, making it a target for attackers seeking to compromise network gateways.

The primary impact of this vulnerability is unauthorized remote command execution on affected D-Link DWR-M961 devices. This can lead to full compromise of the router, allowing attackers to manipulate network traffic, intercept sensitive data, or use the device as a foothold for further attacks within the network. Disruption of network availability is also possible if malicious commands degrade device functionality. For organizations, this could result in data breaches, loss of network integrity, and potential downtime. Small businesses and home users relying on this router model are particularly at risk due to typically weaker network defenses. The medium CVSS score indicates a moderate but non-trivial risk, especially given the public exploit availability and remote attack vector.

Since no official patches or firmware updates are currently linked, organizations should take immediate steps to mitigate risk. These include restricting access to the router’s management interface by limiting it to trusted internal networks and disabling remote management if not required. Network segmentation should be employed to isolate vulnerable devices from critical infrastructure. Monitoring network traffic for unusual activity targeting the /boafrm/formLtefotaUpgradeQuectel endpoint can help detect exploitation attempts. Applying firewall rules to block suspicious requests and enforcing strong authentication on device management interfaces will reduce attack surface. Users should regularly check for firmware updates from D-Link and apply them promptly once available. In environments where patching is delayed, consider replacing affected devices with models not vulnerable to this issue.