The vulnerability CVE-2026-71945 affects D-Link DWR-M961 devices (hardware version C1) running firmware versions prior to 1.1.5_C1_202607071108. It is an OS command injection vulnerability located in the /boafrm/formLtefotaUpgradeFibocom interface. An unauthenticated remote attacker can exploit this by injecting malicious commands into the fota_url parameter, resulting in execution of arbitrary commands with root-level privileges on the device.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands with root privileges on affected devices. This can lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of device functionality. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the vulnerable interface to trusted users only and monitor for suspicious activity targeting the fota_url parameter. Avoid exposing the device management interface to untrusted networks.