A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 firmware allows remote attackers to compromise device stability and potentially execute arbitrary code.

The vulnerability exists in the /boafrm/formWlEncrypt endpoint, specifically within the sub_452CCC function, which performs an unsafe strcpy operation on the submit-url parameter. An attacker with low privileges can trigger this memory corruption to crash the web server or hijack execution flow.

The exploitation of this flaw can result in a complete denial of service, rendering the network gateway unreachable and disrupting business operations. Given the CVSS score of 8.8, the potential for arbitrary code execution with root privileges poses a severe risk to network integrity and confidentiality, as an attacker could gain persistent control over the networking infrastructure.

Immediate Action: Since no patch is explicitly identified, users should restrict administrative access to the device management interface to trusted internal segments only and monitor for firmware updates from the vendor.

Proactive Monitoring: Security teams should monitor network access logs for anomalous POST requests directed at the /boafrm/formWlEncrypt endpoint, particularly those containing unusually long parameter strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) to filter and block HTTP requests containing malformed or excessively long submit-url parameters.

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's published write-up on GitHub.

This vulnerability represents a significant risk to the security of D-Link DWR-M960 routers. Organizations should prioritize isolating these devices from external networks and strictly limiting management access until a vendor-supplied security update is applied. Monitoring for the specific exploitation pattern identified in the proof-of-concept is essential until the underlying software flaw is remediated.