The D-Link DWR-M961 router, hardware version C1, running firmware versions prior to 1.1.5_C1_202607071108, contains an OS command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. An attacker can remotely supply malicious input in the host field, which is improperly neutralized, resulting in execution of arbitrary OS commands with root-level privileges. This vulnerability does not require authentication or user interaction and has a CVSS 4.0 score of 9.3, reflecting its critical impact and high exploitability.

Successful exploitation allows remote attackers to execute arbitrary commands on the device with root privileges, potentially leading to full device compromise. This can affect device availability, confidentiality, and integrity. There are no known exploits in the wild at the time of publication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected interface and monitor for suspicious activity. Avoid exposing the device management interface to untrusted networks.