The vulnerability CVE-2026-71954 affects D-Link DWR-M961 devices (hardware version C1) running firmware versions prior to 1.1.5_C1_202607071108. It is an OS command injection issue in the /boafrm/formL2tpv3ConfigSetup interface, where unsanitized input in the tunnelid and sessionid parameters allows remote attackers to execute arbitrary commands with root privileges. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently provided, and no known exploits in the wild have been reported.

Successful exploitation results in remote, unauthenticated attackers executing arbitrary OS commands with root privileges on affected devices. This compromises the device's confidentiality, integrity, and availability, potentially allowing full control over the device and network disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vulnerable interface and monitor for suspicious activity targeting the /boafrm/formL2tpv3ConfigSetup endpoint. Avoid exposing the device management interface to untrusted networks.