A stack-based buffer overflow vulnerability in D-Link DWR-M960 routers poses a high risk of remote code execution and system compromise.

This vulnerability is a stack-based buffer overflow occurring within the function sub_424AFC of the /boafrm/formFilter endpoint. The flaw is triggered by manipulating the submit-url argument, and the CVSS vector indicates that the attack requires low privileges (PR:L) to execute remotely.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total impact on system confidentiality, integrity, and availability. Successful exploitation allows a remote attacker to crash the device or potentially execute arbitrary code, which could lead to complete loss of control over the network gateway, data interception, and unauthorized access to internal resources.

Immediate Action: Since a specific patch version is not currently provided by the vendor, administrators should restrict network access to the management interface of the DWR-M960 to trusted internal IP addresses only.

Proactive Monitoring: Monitor system logs and network traffic for unusual activity directed toward the /boafrm/formFilter endpoint, specifically looking for abnormally long or malformed URL parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control list (ACL) to block access to the affected administrative endpoint from untrusted sources or public networks.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced in the CVE record.

Given the high severity of this vulnerability and the availability of a public proof-of-concept, users must treat this as an urgent security priority. Until D-Link releases a firmware update to address the overflow in the filter configuration module, ensure the device is not accessible from the internet and monitor for any signs of unauthorized configuration changes.