CVE-2026-1596
Published: 29 January 2026
Summary
CVE-2026-1596 is a medium-severity Injection (CWE-74) vulnerability in Dlink Dwr-M961 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing router firmware directly enables remote exploitation (T1190) and Unix shell command execution (T1059.004).
NVD Description
A flaw has been found in D-Link DWR-M961 1.1.47. This vulnerability affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. The attack is possible to be carried out remotely. The exploit has…
more
been published and may be used.
Deeper analysisAI
CVE-2026-1596 is a command injection vulnerability affecting the D-Link DWR-M961 router on firmware version 1.1.47. The flaw exists in the function sub_419920 within the file /boafrm/formLtefotaUpgradeQuectel, where manipulation of the fota_url argument enables command injection. It is associated with CWEs-74 and CWE-77 and received a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), published on 2026-01-29.
The vulnerability is exploitable remotely by an attacker possessing low privileges. Successful exploitation allows command injection, resulting in low impacts to confidentiality, integrity, and availability, such as limited data exposure, modification, or denial of service on the affected device.
Advisories and additional details are documented in references including VULDB entries (https://vuldb.com/?ctiid.343358, https://vuldb.com/?id.343358, https://vuldb.com/?submit.740693) and the D-Link website (https://www.dlink.com/). A proof-of-concept exploit is publicly available on GitHub (https://github.com/QIU-DIE/CVE/issues/48) and may be used.
The published exploit indicates potential for real-world exploitation of this router firmware vulnerability.
Details
- CWE(s)