The vulnerability CVE-2026-71953 affects D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108. It is an OS command injection flaw located in the /boafrm/formNtp interface, specifically in the ntpServerIp1 field. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device with root-level privileges, potentially compromising the device fully. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet, and no known exploits in the wild have been reported.

Successful exploitation results in remote command execution with root privileges on affected D-Link DWR-M961 devices, allowing full control over the device. This can lead to complete compromise of the device's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device's management interfaces to trusted users only and monitor for suspicious activity targeting the /boafrm/formNtp interface.