D-Link DWR-M961 app.cgi Command Injection (CVE-2026-71956)

Technical Analysis

The vulnerability resides in the app.cgi web management interface, where the netDig.ping.dst field fails to sanitize user input before passing it to a system-level command (likely used for diagnostic ping/traceroute functionality). This allows an attacker to inject shell metacharacters or command chains to achieve arbitrary command execution as root, without requiring authentication. Given the CVSS 9.8 rating, exploitation likely requires no user interaction and is remotely reachable over the network interface exposing app.cgi. Successful exploitation grants full device compromise, enabling traffic interception, pivoting into internal networks, DNS hijacking, or deployment of persistent malware/botnet implants (e.g., Mirai-style). Organizations that route AI agent traffic, RAG pipeline API calls, or LLM tool-use requests through compromised DWR-M961 devices are at risk of traffic interception, credential/API key theft, and man-in-the-middle manipulation of agent communications, warranting classification as agent-relevant infrastructure risk.

Affected Systems

D-Link DWR-M961 routers, hardware version C1, running firmware version 1.1.2_C1_202602110044 (and potentially earlier/later versions sharing the vulnerable app.cgi code path)

Indicators of Compromise

• Vulnerable endpoint: /app.cgi
• Affected parameter: netDig.ping.dst
• No public hashes, IPs, or domains reported at time of disclosure

Remediation Steps

1. 1

   Apply vendor patch

   Check D-Link's security advisory page for a firmware update addressing CVE-2026-71956 and apply it immediately once released.

2. 2

   Restrict management interface access

   Disable remote/WAN access to the device's web management interface (app.cgi) and restrict access to trusted internal IP ranges only.

3. 3

   Network segmentation

   Isolate D-Link DWR-M961 devices, especially those used as gateways for AI agent or RAG pipeline traffic, from critical internal networks via VLAN segmentation.

4. 4

   Monitor for exploitation

   Inspect device logs and network traffic for anomalous requests to app.cgi containing shell metacharacters or unusual netDig.ping.dst values.

5. 5

   Replace end-of-life hardware

   If no patch is issued, consider decommissioning affected devices in favor of routers with active vendor security support.