CVE-2026-71955 is a critical command injection vulnerability in the D-Link DWR-M961 consumer router, affecting the /boafrm/formWsc endpoint that handles Wi-Fi Simple Config (WPS) parameters. Four fields—localPin, targetAPSsid, peerPin, and peerRPTPin—are each independently injectable, meaning an attacker can achieve root-level command execution through any one of them. The CVSS 9.8 rating reflects this severity: unauthenticated remote attackers can gain full device compromise without authentication.
What makes this more dangerous than the score alone conveys is the device's network position. The DWR-M961 is frequently deployed as an ISP-provided gateway or SOHO perimeter router. Compromising it gives the attacker control not just of the device, but of the DNS resolver, DHCP server, and NAT boundary for every device behind it. There's no lateral movement required—the traffic already flows through the compromised chokepoint.
The WPS protocol was formally deprecated by the Wi-Fi Alliance in 2021, and the Boa web server has been unmaintained since approximately 2013. This isn't a newly-introduced coding error; it's forgotten infrastructure running forgotten code. Combined with D-Link's documented history of similar command injection vulnerabilities in Boa-based firmware, this pattern suggests the broader question isn't whether other form handlers in this firmware are vulnerable—it's which ones haven't been found yet.
Immediate actions: verify whether the router's web management interface is exposed to the internet (the 'remote' classification suggests it may be reachable), disable WPS if possible as a defense-in-depth measure, and monitor D-Link's firmware release page for patches. If you're responsible for D-Link consumer router fleets, treat the entire web management interface as potentially compromised until proven otherwise—this is the same code path pattern that has produced multiple critical CVEs across their product line over the past decade.