A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 firmware version 1.01.07 exposes the device to remote code execution and service disruption.

The vulnerability exists in the /boafrm/formIpQoS endpoint within the sub_427D74 function. By sending a crafted POST request with an oversized submit-url parameter, an authenticated user can trigger a stack-based buffer overflow due to the unsafe use of the strcpy function.

Successful exploitation of this vulnerability allows an attacker to crash the device web server, leading to a denial of service, or potentially hijack the device execution flow to run arbitrary code with root-level privileges. Given the CVSS score of 8.8, this vulnerability poses a high risk to network infrastructure, as it could be leveraged to gain persistence or facilitate further lateral movement within the network.

Immediate Action: Check the D-Link support portal for the latest firmware updates and apply them immediately to the affected DWR-M960 devices.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at /boafrm/formIpQoS and watch for unexpected device reboots or service outages.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses and employ a WAF or intrusion detection system to filter oversized or malformed HTTP POST parameters.

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the researcher's published write-up (GitHub).

The presence of a published proof-of-concept combined with the potential for arbitrary code execution necessitates immediate attention. Administrators should prioritize patching the affected firmware versions to eliminate the underlying memory corruption flaw and prevent unauthorized control over the device.