CVE-2026-71946 is an OS command injection vulnerability affecting D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. The vulnerability exists in the /boafrm/formPingDiagnosticRun interface, where insufficient neutralization of special elements in the host field allows remote attackers to execute arbitrary commands with root privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation enables remote attackers to execute arbitrary commands on the device with root privileges, potentially leading to full device compromise. This can affect device confidentiality, integrity, and availability severely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict network access to the vulnerable interface and monitor for suspicious activity targeting this endpoint.