The D-Link DWR-M961 router, hardware version C1, running firmware versions prior to 1.1.5_C1_202607071108, contains an OS command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. An attacker can remotely supply malicious input to the fota_url parameter, which is improperly neutralized, allowing arbitrary command execution with root privileges. This vulnerability is unauthenticated and requires no user interaction, making it highly critical. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability.

Successful exploitation enables remote attackers to execute arbitrary commands on the affected device with root privileges, potentially leading to full device compromise. This can result in unauthorized control, data theft, or disruption of device functionality. The vulnerability does not require authentication or user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected interface and monitor for suspicious activity targeting the /boafrm/formLtefotaUpgradeQuectel endpoint. Consider isolating affected devices from untrusted networks to reduce exposure.