D-Link DWR-M961 Router Hit by Command Injection and Buffer Overflow Flaws

D-Link patched 15 flaws in its DWR-M961 router this month. Most are D-Link router command injection bugs, and two are buffer overflow flaws. Also, the issues sit inside the router’s web management tools. So, owners of hardware revision C1 should update firmware right away.

Notable CVEs

Why It Matters

These bugs live in the router’s admin interface. That interface controls SIM settings, network diagnostics, and firmware updates. An attacker who reaches this interface could run system commands or crash key services. Because these bugs touch so many endpoints, the attack surface is wide. Meanwhile, home and small office users often leave admin panels open on the local network, which raises the real-world risk.

How the Attacks Work

Command Injection in Upgrade and Diagnostic Tools

The first group of bugs sits in the router’s upgrade and diagnostic tools. FOTA upgrade handlers for Quectel and Fibocom modems pass a URL field straight into a system command. Similarly, the ping, traceroute, and debug diagnostic tools reuse a host field the same way. For example, a crafted value in that field can run commands the developer never intended.

Command Injection in Messaging and Modem Settings

A second group covers messaging and modem functions. USSD, SMS, IMEI, and PIN management handlers all pass user input into commands without proper checks. The NTP and L2TPv3 configuration tools share the same flaw, and so does the WPS setup handler. One WPS finding failed to filter a dollar sign, which allowed shell expansion inside a quoted command. Then, another finding in this group stores a bad value first and triggers it later through a separate request. In addition, a related flaw in app.cgi’s diagnostic function follows the same command injection pattern.

Buffer Overflow in app.cgi and quicksetup.cgi

Two other flaws work differently. One sits in app.cgi, where a long access control name overruns its buffer. The other lives in quicksetup.cgi, where setup fields like username and ssid2 can overflow memory. Both can crash the web service or corrupt memory once triggered. Still, no source confirms active attacks, and no public proof of concept exists for any of these findings.

Affected Versions

The flaws affect the DWR-M961 with hardware revision C1. Affected firmware is version 1.1.2_C1_202602110044 or earlier. D-Link’s US division did not sell this model in the United States. So, the advisory covers non-US and global markets only. Then, the fix ships in firmware 1.1.5_C1_202607071108, released in August 2026. D-Link has not published install or user counts for this model.

Patch and Mitigation Steps

D-Link fixed all 15 issues in firmware 1.1.5_C1_202607071108. Update as soon as you can, since patching remains the best defense. Confirm your model is DWR-M961 with hardware revision C1 before you download anything. Then grab the correct firmware file and install it. After the update, check that the admin panel shows the new firmware version.

D-Link’s security advisory states plainly that it “takes network security and user privacy seriously.” Furthermore, the company credited researcher Jincheng Wang and two university professors for the coordinated disclosure. Patching this D-Link router command injection and buffer overflow risk closes the book on all 18 reported findings.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.