Command Injection in D-Link DWR-M961 Firmware

Executive Summary

This vulnerability is a command injection flaw in D-Link DWR-M961 routers with hardware version C1 and firmware before 1.1.5_C1_202607071108. It allows remote attackers to inject malicious commands into the oldPIn field of the /boafrm/formPinManageSetup interface, executing commands with root privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your D-Link DWR-M961 device is running firmware version before 1.1.5_C1_202607071108. Use the device's admin interface or SSH to verify the firmware version. Scan network traffic for suspicious POST requests to /boafrm/formPinManageSetup with command injection attempts in the oldPIn field.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full control of the router, allowing them to intercept network traffic, install malware, or use the device as part of a botnet. This could lead to data theft, unauthorized access to connected devices, or disruption of network services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected devices may face compliance failures, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the firmware to version 1.1.5_C1_202607071108 or later. Disable remote access to the admin interface if not required. Restrict network access to the device using firewall rules. Monitor logs for unauthorized command injection attempts.

Useful 0 Not Useful 0