The D-Link DWR-M961 router, hardware version C1, running firmware versions prior to 1.1.5_C1_202607071108, contains an OS command injection vulnerability in the /boafrm/formSmsManage interface. An unauthenticated remote attacker can exploit improper neutralization of special elements in the action_value parameter to execute arbitrary OS commands with root privileges. This vulnerability is critical, with a CVSS 4.0 base score of 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device with root privileges, potentially compromising the device's confidentiality, integrity, and availability. This could lead to full device takeover, unauthorized access to network resources, and disruption of services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for suspicious activity targeting the /boafrm/formSmsManage endpoint.