A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 firmware version 1.01.07 allows authenticated attackers to compromise device integrity and availability.

This is a stack-based buffer overflow occurring in the sub_453140 function within the /boafrm/formWlAc endpoint. An authenticated attacker can trigger this vulnerability by sending a crafted HTTP POST request with an oversized submit-url parameter, which lacks necessary length validation.

Successful exploitation of this vulnerability can lead to a complete denial of service by crashing the device web server or causing an unexpected reboot, resulting in significant network downtime. Furthermore, the memory corruption can be leveraged to achieve arbitrary code execution with root privileges, potentially granting an attacker full control over the router and access to sensitive network traffic. The CVSS score of 8.8 reflects the high severity of this impact on network infrastructure.

Immediate Action: Since no official patch is currently available, administrators should restrict administrative access to the device management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for recurrent crashes or unexpected service restarts, and inspect network traffic for unusually large POST requests directed at the /boafrm/formWlAc endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to drop HTTP requests containing excessively long parameters in the submit-url field, or disable the wireless access control configuration interface if it is not strictly required.

Public Exploit Available: Yes, a proof-of-concept is documented in the researcher write-up linked in the CVE record.

Given the high CVSS score and the availability of a published proof-of-concept, users of the D-Link DWR-M960 should treat this vulnerability with high priority. Organizations must implement strict network segmentation to limit access to the administrative interface and wait for official firmware remediation from the vendor.