CVE-2026-71949 is an OS command injection vulnerability affecting D-Link DWR-M961 devices (hardware version C1) running firmware versions prior to 1.1.5_C1_202607071108. The vulnerability exists in the /boafrm/formUSSDSetup interface, where unsanitized input in the ussdValue and selectMenuValue parameters allows an unauthenticated remote attacker to execute arbitrary OS commands with root privileges. This vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation information is currently available from the vendor, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the affected device with root privileges, potentially leading to full system compromise, data theft, or disruption of device functionality. The vulnerability affects device confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected interface and monitor for suspicious activity related to the /boafrm/formUSSDSetup endpoint. Avoid exposing the device management interface to untrusted networks.