The D-Link DWR-M961 router, hardware version C1, running firmware versions prior to 1.1.5_C1_202607071108, contains an OS command injection vulnerability in the /boafrm/formIMEISetup interface. An unauthenticated remote attacker can exploit improper neutralization of special elements in the IMEI_value parameter to execute arbitrary commands with root privileges on the device. This vulnerability is classified as critical with a CVSS 4.0 score of 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation results in remote command execution with root privileges on affected devices, potentially allowing full control over the device and compromise of network security. The vulnerability does not require authentication or user interaction, increasing its risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, affected devices should be isolated from untrusted networks to reduce exposure. Monitor vendor communications for firmware updates addressing this issue.