A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 routers allows remote, authenticated attackers to cause denial of service or potentially execute arbitrary code.

The vulnerability is located in the sub_4237AC function within the /boafrm/formLteSetup endpoint. By sending a crafted POST request with an oversized submit-url parameter, an authenticated attacker can trigger a buffer overflow due to the unsafe use of the strcpy function.

Successful exploitation of this flaw poses a severe risk to network availability and integrity. Because the vulnerability allows for memory corruption, an attacker can crash the web server, leading to a denial of service that disrupts internet connectivity for all users on the network. Furthermore, the potential for arbitrary code execution with root-level privileges could allow an attacker to gain full control over the router, facilitating man-in-the-middle attacks or lateral movement within the local network. The CVSS score of 8.8 reflects the high severity of this remote code execution capability.

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the web management interface to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual POST requests directed at the /boafrm/formLteSetup endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or truncate excessively long submit-url parameters in POST requests sent to the router.

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's published write-up on GitHub.

Given the high CVSS score and the public availability of technical details and proof-of-concept code, this vulnerability should be treated with high priority. Organizations using D-Link DWR-M960 routers must immediately isolate the management interface from the public internet and monitor for firmware update availability from the vendor to remediate the underlying memory corruption flaw.