A critical buffer overflow vulnerability in the D-Link DWR-M960 router, identified as CVE-2026-2884, poses a significant risk of remote code execution and system instability.

This vulnerability is a stack-based buffer overflow located in the function sub_41914C of the /boafrm/formWanConfigSetup endpoint. An authenticated attacker can trigger the flaw by sending a crafted HTTP POST request with an oversized submit-url parameter, which lacks necessary length validation before being copied into a fixed-size buffer.

The exploitation of this vulnerability allows for severe system compromise, including the potential for arbitrary code execution with root-level privileges. Given the CVSS score of 8.8, this flaw represents a high risk to business operations, as it could lead to unauthorized network access, complete loss of router availability, or the use of the device as a pivot point for further lateral movement within the internal network.

Immediate Action: Update the D-Link DWR-M960 firmware to the latest available version provided by the vendor to patch the buffer overflow vulnerability.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /boafrm/formWanConfigSetup endpoint and review system logs for recurring web server crashes or unexpected reboots.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and restrict the length of parameters in HTTP requests, specifically targeting the submit-url field to block oversized payloads.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up provided by the researcher on GitHub.

Due to the high severity of this vulnerability and the availability of a public proof-of-concept, immediate remediation is required. Administrators should prioritize patching the affected DWR-M960 devices to prevent unauthorized access or system-wide denial of service. If a patch cannot be applied immediately, restrict administrative access to the web interface to trusted internal segments only.