Reported by 2 outlets

Timeline

1. update from cyberpress.org

   D-Link Fixes 18 Security Flaws in DWR-M961 Router Web Interface

   cyberpress.org · 55d ago · August 19th, 2026

   D-Link has released firmware updates for 18 reported security findings affecting the web management interface of its DWR-M961 4G LTE router (hardware revision C1). The flaws, tracked under 15 CVE identifiers, include numerous command injection issues and three buffer overflow vulnerabilities. The affected device was running firmware version 1.1.2_C1_202602110044. D-Link addressed the reported issues in firmware version 1.1.5_C1_202607071108, released for the DWR-M961 C1 hardware revision. D-Link Fixes 18 Security Flaws Most of the flaws reside in CGI handlers used by the router’s administrative web interface. Command injection issues affect FOTA update functions, network diagnostic tools, USSD and SMS operations, SIM configuration, NTP settings, L2TPv3 configuration, and WPS functionality. An attacker who can submit crafted input to a vulnerable management interface could cause router-side commands to be processed unexpectedly. According to D-Link’s advisory , the particularly notable areas include Ping, Traceroute, and Debug diagnostics, where user-controlled host values were reported to be vulnerable. The L2TPv3 issue is classified as stored command injection. It involves storing crafted tunnelid or sessionid values through one configuration request, followed by a subsequent request that causes the stored values to be used in a system command. Three WPS-related findings share CVE-2026-71955. The affected formWsc handler includes local PIN, peer PIN, and target SSID input pa

2. update from gbhackers.com

   D-Link DWR-M961 Router Hit by 15 Command Injection and Buffer Overflow Vulnerabilities

   gbhackers.com · 55d ago · August 19th, 2026

   D-Link has disclosed and patched 15 Common Vulnerabilities and Exposures (CVEs) affecting its DWR-M961 4G/LTE router, specifically hardware revision C1. This follows the discovery of multiple command injection and buffer overflow vulnerabilities in the device’s web management components. These vulnerabilities affect non-US DWR-M961 devices running firmware versions 1.1.2_C1_202602110044 and earlier revisions. D-Link DWR-M961 Router Flaw […] The post D-Link DWR-M961 Router Hit by 15 Command Injection and Buffer Overflow Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .