A critical buffer overflow vulnerability in the D-Link DWR-M960 router allows remote attackers to compromise device stability or gain unauthorized code execution.

This is a stack-based buffer overflow occurring within the sub_462590 function of the Operation Mode configuration endpoint (/boafrm/formOpMode). By sending a crafted POST request with an oversized submit-url parameter, a remote, authenticated attacker can trigger memory corruption due to unsafe usage of the strcpy function.

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. An attacker could trigger a Denial of Service (DoS) by crashing the web service or potentially achieve remote code execution with root-level privileges, leading to full device compromise. Given the CVSS score of 8.8, this vulnerability is considered High severity, and the ability to control network traffic through a compromised router represents a significant threat to internal data confidentiality and integrity.

Immediate Action: Users should check the D-Link support portal for the latest firmware updates and apply them immediately to address the insecure memory handling in the configuration endpoint.

Proactive Monitoring: Security teams should monitor network traffic for anomalous POST requests directed at the /boafrm/formOpMode endpoint, especially those containing unusually large payloads in the submit-url parameter.

Compensating Controls: If a patch is not immediately available, restrict access to the web management interface to trusted administrative IP addresses only, or place the device behind a restrictive firewall to limit exposure to untrusted networks.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

The vulnerability in the D-Link DWR-M960 represents a high-risk security flaw that could lead to full system takeover. Organizations utilizing this hardware should prioritize applying vendor-supplied security updates to remediate the buffer overflow. If patching is delayed, immediate network segmentation and restricted access to the management interface are necessary to prevent unauthorized exploitation.