A critical buffer overflow vulnerability in D-Link DWR-M960 routers could allow remote attackers to achieve arbitrary code execution or crash the device.

This is a stack-based buffer overflow occurring in the sub_44E0F8 function within the /boafrm/formNewSchedule endpoint. By sending a specially crafted, oversized submit-url parameter to the device, a low-privileged authenticated attacker can corrupt memory to trigger a crash or hijack execution flow.

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. Because the web server typically runs with root privileges, an attacker could gain full control over the router, enabling persistent unauthorized access, traffic interception, or total network compromise. The CVSS score of 8.8 reflects the high potential for system-wide impact and the relative ease of exploitation.

Immediate Action: Check the D-Link support portal for the latest firmware release and update the device immediately to a version beyond 1.01.07. If no patch is available, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for repeated crashes or unauthorized attempts to access the /boafrm/formNewSchedule endpoint. Inspect network traffic for unusually large POST requests directed at the router management interface.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control list (ACL) to block requests to the vulnerable management endpoint from untrusted sources. Ensure the device management interface is not exposed to the public internet.

Public Exploit Available: Yes, a functional proof-of-concept is documented in the referenced GitHub research write-up.

Given the potential for remote code execution and the availability of a public proof-of-concept, this vulnerability should be treated as a high-priority item for remediation. Administrators must prioritize firmware updates and ensure that router management interfaces are strictly isolated from the public internet to prevent unauthorized exploitation.