D-Link DWR-M961 Command Injection via LTE FOTA Upgrade Interface

Technical Analysis

CVE-2026-71944 is a command injection vulnerability residing in the /boafrm/formLtefotaUpgradeQuectel endpoint of D-Link DWR-M961 hardware revision C1 devices. The vulnerability arises from insufficient input sanitization of the fota_url field, which is passed to an underlying system call responsible for initiating firmware-over-the-air updates on the embedded Quectel LTE module. By injecting shell metacharacters into this field, a remote attacker can execute arbitrary OS commands with root privileges, achieving full device takeover without authentication in many typical deployment scenarios. This class of vulnerability is common in consumer/SMB-grade IoT routers where web management interfaces (boafrm-based CGI handlers) lack proper input validation and run with elevated privileges. If a compromised router serves as the network gateway or DNS resolver for infrastructure hosting AI agents, RAG pipelines, or LLM tool-use frameworks, an attacker could intercept, redirect, or manipulate API traffic and credentials exchanged between agents and their backend services, enabling downstream data exfiltration or man-in-the-middle attacks against agent communications.

Affected Systems

D-Link DWR-M961 routers, hardware version C1, firmware versions prior to 1.1.5_C1_202607071108

Indicators of Compromise

• No specific IOCs published; monitor for anomalous HTTP POST requests to /boafrm/formLtefotaUpgradeQuectel containing shell metacharacters (;, |, &, $(), backticks) in the fota_url parameter

Remediation Steps

1. 1

   Apply Firmware Update

   Upgrade all affected D-Link DWR-M961 (hardware C1) devices to firmware version 1.1.5_C1_202607071108 or later immediately.

2. 2

   Restrict Management Interface Access

   Disable or restrict remote/WAN access to the router's web management interface; limit access to trusted LAN administrators only.

3. 3

   Network Segmentation

   Isolate IoT and network infrastructure devices, including routers, from segments hosting critical servers, AI agent workloads, or sensitive credential stores.

4. 4

   Monitor and Log

   Enable logging on the device and upstream firewall/IDS to detect suspicious requests to FOTA upgrade endpoints or unexpected outbound connections from the router.

5. 5

   Rotate Exposed Credentials

   If the device was potentially exposed, rotate any API keys, VPN credentials, or secrets that traverse the affected router, especially those used by downstream AI agent or automation systems.