A critical remote buffer overflow vulnerability in D-Link DWR-M920 routers poses a severe risk of system compromise due to the availability of a public exploit.

The vulnerability exists in the sub_423848 function within the /boafrm/formParentControl endpoint, which fails to perform bounds checking on the submit-url argument before passing it to the strcpy function. This allows a remote, authenticated attacker to trigger a buffer overflow and corrupt system memory.

Successful exploitation of this buffer overflow can result in a complete system crash or arbitrary code execution on the affected router. Given the device's role as a network gateway, this represents a significant threat to internal network security, potentially enabling unauthorized access to private traffic or lateral movement into the local network. The CVSS score of 8.8 reflects the high severity of this impact.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the web management interface, ensuring it is not exposed to the public internet.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /boafrm/formParentControl endpoint and investigate any unexpected router reboots or service instability.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System to block requests containing excessively long submit-url parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research writeup provided by the vulnerability reporter.

The presence of a public proof-of-concept significantly increases the risk of exploitation. Organizations utilizing the D-Link DWR-M920 must prioritize isolating these devices from external access until the vendor releases a firmware update that addresses the memory safety issue in the formParentControl component.