CVE-2026-71949

CVE-2026-71949 is a command injection in D-Link's DWR-M961 router, affecting the formUSSDSetup handler. This handler processes telecom USSD (Unstructured Supplementary Service Data) requests—a protocol that's functionally dead in most markets, replaced by SMS and app-based services years ago. The vulnerability works exactly the way these have always worked: user-supplied input from the web interface flows unsanitized into a system() or exec() call. Basic web fuzzing discovers it. The CVSS 9.8 reflects the reality that exploitation is trivial and the impact is complete device compromise. What matters for defenders: USSD functionality was almost certainly added to pass carrier certification requirements, shipped, and then orphaned. The formUSSDSetup handler has likely sat unmaintained for years—no one testing it, no one reviewing it, no one remembering it exists. This is not an isolated case; it's the same forgotten-code pattern that produces command injection after command injection in consumer router firmware. The practical implications are stark. First, check whether your DWR-M961 is still within vendor support windows—the C1 hardware revision may already be end-of-life, meaning no patch is coming regardless of severity. Second, assume the USSD handler is not the only forgotten code path on that device; basic fuzzing of other telecom-related handlers (CSS, CWMP, TR-069 provisioning) will likely yield additional findings. Third, treat any compromised router as a network pivot—the attacker gains the ability to DNS-poison, intercept traffic, and persist across factory resets if they've modified the firmware. If you cannot patch, segment the device aggressively. Place it behind a restrictive firewall policy that assumes the attacker has already achieved command injection. Monitor for unexpected outbound connections from the router to unusual IP ranges, which would indicate the device has been conscripted into a botnet or is being used for lateral movement. The exposure window for this class of vulnerability in consumer hardware routinely stretches to years; do not expect vendor remediation to arrive in time to prevent opportunistic exploitation.

Reviewed through automated stages and approved by a human before publication.