🔥 CyberForge CVE of the Day #020 🚨CVE-2026-1596 — D-Link DWR-M961 LTE Router Command Injection. A High-severity command injection vulnerability affects D-Link DWR-M961 LTE routers running firmware 1.1.47. ⭐ CVSS: 8.8 High (NVD) 💥 Impact: OS command execution 🔐 Privileges: Low 📦 Affected: DWR-M961 1.1.47 ✅ Fixed: Firmware 1.1.54 🧪 Public PoC: Yes 🚨 Active Exploitation: No authoritative evidence identified 🏛️ CISA KEV: Not found during review The flaw exists in /boafrm/formLtefotaUpgradeQuectel, where attacker-controlled fota_url input can influence command execution. 💥 Why this becomes code execution. The vulnerability class here is: CWE-74 — Improper Neutralisation of Special Elements in Output Used by a Downstream Component CWE-77 — Command Injection as recorded in the NVD/CNA data. Once un-trusted input is interpreted as part of a shell/system command, the application is no longer treating that input purely as: (data) Instead, some of it may become: (command syntax) That semantic boundary failure is the vulnerability. Two sibling flaws affect the same firmware family: • CVE-2026-1624 — Fibocom FOTA command injection • CVE-2026-1625 — SMS management command injection The pattern suggests broader unsafe command construction across management functions. 🖥️Vulnerable firmware: 1.1.47 🛡️Defenders should update to 1.1.54+, disable unnecessary WAN administration, restrict management access and review DNS, firewall, NAT and authentication logs for suspicious changes. 🔗 https://nvd.nist.gov/vuln/detail/CVE-2026-1596 #CyberForge #CVE #DLink #DWRM961 #RouterSecurity #CommandInjection #CyberSecurity
Post summary
D-Link DWR‑M961 LTE routers are vulnerable to a high‑severity command injection (CVE‑2026‑1596) in firmware 1.1.47; the flaw is publicly demonstrated but not actively exploited. Updating to firmware 1.1.54 and disabling unnecessary administration interfaces mitigates the risk.