D-Link DWR-M961 Buffer Overflow via quicksetup.cgi 漏洞概述 严重性: CRITICAL 日期: 8/8/2026 影响: DWR-M961 < 1.1.5_C1_202607071108 CVE: CVE-2026-71958 CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CVSS: 9.3 CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 参考: - D-Link Advisory - Product Webpage 贡献者: Jincheng Wang (@winmt), Professor Le Yu of Nanjing University of Posts and Telecommunications, and Professor Xiapu Luo of The Hong Kong Polytechnic University 描述: D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash. 影响范围 受影响设备: D-Link DWR-M961 硬件版本: C1 软件版本: 1.1.2_C1_202602110044 修复方案 建议: 更新设备至最新版本，避免使用存在漏洞的quicksetup.cgi接口。