The D-Link DWR-M961 router with hardware version C1 and software version 1.1.2_C1_202602110044 contains an OS command injection vulnerability in the app.cgi interface. Specifically, the netDig.ping.dst field does not properly neutralize special elements, allowing a remote attacker to inject arbitrary commands. Successful exploitation results in execution of commands with root privileges on the device. This vulnerability is publicly documented as CVE-2026-71956 with a CVSS 4.0 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Remote attackers can execute arbitrary OS commands with root privileges on affected D-Link DWR-M961 devices, potentially leading to full device compromise. This can result in unauthorized control, data theft, or disruption of device functionality. The vulnerability is exploitable over the network without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface and monitor for suspicious activity related to the app.cgi interface. Avoid exposing the device management interface to untrusted networks.