CVE-2026-1624
📋 TL;DR
This CVE describes a command injection vulnerability in D-Link DWR-M961 routers that allows remote attackers to execute arbitrary commands by manipulating the fota_url parameter. The vulnerability affects D-Link DWR-M961 routers running firmware version 1.1.47. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- D-Link DWR-M961
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, pivot to internal networks, intercept traffic, or use device as part of botnet.
Likely Case
Remote code execution leading to device takeover, credential theft, network reconnaissance, or denial of service.
If Mitigated
Limited impact if device is behind firewall with restricted inbound access and proper network segmentation.
🎯 Exploit Status
Public exploit details available on GitHub. Attack requires network access to device web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dlink.com/
Restart Required: Yes
Instructions:
1. Check D-Link website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot device.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external access to router web interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Endpoint Disable
allDisable LTE FOTA upgrade functionality if not required.
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious traffic to/from affected devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System > Firmware. If version is 1.1.47, device is vulnerable.Check Version:
curl -s http://router-ip/status.html | grep -i firmwareVerify Fix Applied:
After firmware update, verify version is no longer 1.1.47. Test endpoint /boafrm/formLtefotaUpgradeFibocom with controlled payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /boafrm/formLtefotaUpgradeFibocom
- Suspicious command execution in system logs
- Multiple failed login attempts followed by successful access
Network Indicators:
- Unexpected outbound connections from router
- Traffic to known malicious IPs from router
- Unusual port scanning originating from router
SIEM Query:
source="router-logs" AND (uri="/boafrm/formLtefotaUpgradeFibocom" OR cmd="wget" OR cmd="curl" OR cmd="sh")