A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 routers allows for potential remote code execution or denial of service.

The vulnerability exists in the Bridge VLAN configuration endpoint, specifically within the sub_42B5A0 function, due to the unsafe use of the strcpy function when handling the submit-url parameter. An attacker with low privileges can trigger this memory corruption by sending a crafted HTTP POST request to the device.

A successful exploit of this vulnerability could lead to a complete denial of service, rendering the network infrastructure unusable. More critically, the potential for arbitrary code execution with root-level privileges poses a severe risk of unauthorized access to sensitive internal network traffic and total device compromise. With a CVSS score of 8.8, this vulnerability represents a high-severity threat to business continuity and data security.

Immediate Action: There is currently no vendor-provided patch for this vulnerability; users should restrict management interface access to trusted internal networks only and disable remote administration features until an official firmware update is released.

Proactive Monitoring: Monitor device logs for unexpected reboots or service crashes, and inspect network traffic for anomalous HTTP POST requests directed toward the /boafrm/formBridgeVlan endpoint.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to block unauthorized access to the router management interface and filter requests containing excessively long URL parameters.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher LX-66-LX via their GitHub technical write-up.

Given the high CVSS score and the public availability of a proof-of-concept, this vulnerability should be treated with high priority. Organizations using the affected D-Link hardware must immediately isolate the management interface and maintain vigilance for vendor security updates to mitigate the risk of remote code execution.