Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-08 | 1 | Disclosure1 |
| 2026-08-09 | 2 | Disclosure2 |
A new vulnerability with increased severity was disclosed for D-Link DWR-M961 (CVE-2026-71954) https://vuldb.com/vuln/387202
Post summary
A new vulnerability, CVE-2026-71954, has been disclosed for the D-Link DWR-M961 router, with an increased severity score; further details are available via the cited link.
CVE-2026-71954 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3… https://www.cve.org/CVERecord?id=CVE-2026-71954
Post summary
CVE-2026-71954 details a command injection flaw in D-Link DWR‑M961 devices running firmware versions prior to 1.1.5_C1_202607071108, affecting the /boafrm/formL2tpv3 endpoint. No patch, exploit, or PoC information is included.
🚨*CVE* CVE-2026-71954 D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3… https://www.cve.org/CVERecord?id=CVE-2026-71954 ----- Traducción: CVE-2026-71954 Dis… http://infoflow.cloud`
Post summary
The post announces CVE-2026-71954, detailing a command injection vulnerability on specific D-Link devices, but provides no PoC, exploit code, or mitigation information.