The D-Link DWR-M961 router, specifically hardware version C1 running firmware versions prior to 1.1.5_C1_202607071108, is affected by an OS command injection vulnerability identified as CVE-2026-71944. The vulnerability exists in the /boafrm/formLtefotaUpgradeQuectel interface, where the fota_url parameter is improperly neutralized, allowing remote attackers to execute arbitrary OS commands with root privileges. This vulnerability is remotely exploitable without authentication and does not require user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the device with root privileges, potentially leading to full system compromise. This could impact device confidentiality, integrity, and availability. The vulnerability is critical due to its remote, unauthenticated nature and the high privileges gained upon exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected interface and monitor for suspicious activity. Avoid exposing the device management interface to untrusted networks.