A critical buffer overflow vulnerability in the D-Link DWR-M960 router enables authenticated attackers to compromise system stability or execute arbitrary code.

This flaw is a stack-based buffer overflow located in the sub_425FF8 function of the /boafrm/formFirewallAdv endpoint. An authenticated attacker can trigger the overflow by sending a crafted POST request with an oversized submit-url parameter, leading to memory corruption.

Successful exploitation of this vulnerability can lead to a complete Denial of Service, rendering the network device unreachable and disrupting critical business communications. Furthermore, the potential for arbitrary code execution with root-level privileges poses a severe risk of total device takeover, allowing attackers to intercept traffic or pivot into the internal network. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate remediation.

Immediate Action: Contact D-Link support or check the official firmware portal for an available security patch for hardware version B1, as no public fix is currently confirmed.

Proactive Monitoring: Monitor device access logs for unusual POST requests directed at the /boafrm/formFirewallAdv endpoint, particularly those containing abnormally long strings in the submit-url parameter.

Compensating Controls: Restrict access to the router web management interface to trusted administrative IP addresses only, and utilize a network-based firewall to block suspicious traffic patterns.

Public Exploit Available: Yes, a published proof-of-concept exists in a researcher's GitHub repository.

Given the availability of a public proof-of-concept and the potential for root-level code execution, this vulnerability represents a significant risk to organizational infrastructure. Administrators should prioritize restricting administrative access to the affected hardware and verifying the current firmware status with the vendor. Applying the necessary security updates as soon as they are released by D-Link is essential to maintaining network integrity.