GCVE - cpe:2.3:o:dlink:dwr-m961_firmware:1.1.47:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:dlink:dwr-m961_firmware:1.1.47:*:*:*:*:*:*:*

part: o version: 1.1.47 update: *

Vendor	Dlink (`b610c9ff-f722-5d9d-a6df-9bee7f4d4b44`)
Product	Dwr M961 Firmware (`51305934-5baa-5faa-ae08-8530207f4108`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-1625`	vulnerable	2026-06-08 07:49:09.043640	D-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injection MEDIUM (6.3) A vulnerability was detected in D-Link DWR-M961 1.1.47. The impacted element is the function sub_4250E0 of the file /boafrm/formSmsManage of the component SMS Message. Performing a manipulation of the argument action_value results in command injection. The attack may be initiated remotely. The exploit is now public and may be used. Published: 2026-01-29T22:02:13.222Z Updated: 2026-02-23T09:07:33.474Z Open on db.gcve.eu Reference links https://vuldb.com/?id.343384 https://vuldb.com/?ctiid.343384 https://vuldb.com/?submit.740792 https://github.com/QIU-DIE/CVE/issues/51 https://www.dlink.com/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-1624`	vulnerable	2026-06-08 07:49:09.043111	D-Link DWR-M961 formLtefotaUpgradeFibocom command injection MEDIUM (6.3) A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of the argument fota_url leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Published: 2026-01-29T22:02:10.195Z Updated: 2026-02-23T09:07:19.760Z Open on db.gcve.eu Reference links https://vuldb.com/?id.343383 https://vuldb.com/?ctiid.343383 https://vuldb.com/?submit.740770 https://github.com/QIU-DIE/CVE/issues/50 https://www.dlink.com/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-1596`	vulnerable	2026-06-08 07:49:08.972914	D-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injection MEDIUM (6.3) A flaw has been found in D-Link DWR-M961 1.1.47. This vulnerability affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. Published: 2026-01-29T15:32:11.790Z Updated: 2026-02-23T09:05:29.768Z Open on db.gcve.eu Reference links https://vuldb.com/?id.343358 https://vuldb.com/?ctiid.343358 https://vuldb.com/?submit.740693 https://github.com/QIU-DIE/CVE/issues/48 https://www.dlink.com/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-13304`	vulnerable	2026-06-08 07:04:31.954006	D-Link DWR-M920/DWR-M921/DWR-M960/DWR-M961/DIR-825M formPingDiagnosticRun buffer overflow HIGH (8.8) A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. Published: 2025-11-17T22:32:07.051Z Updated: 2025-11-18T16:36:42.638Z Open on db.gcve.eu Reference links https://vuldb.com/?id.332644 https://vuldb.com/?ctiid.332644 https://vuldb.com/?submit.691808 https://vuldb.com/?submit.691810 https://vuldb.com/?submit.691812	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.