A critical stack-based buffer overflow vulnerability in D-Link DWR-M960 routers allows for remote device compromise and service disruption.

The vulnerability exists in the /boafrm/formVpnConfigSetup endpoint within the sub_4196C4 function. An attacker with low-level privileges can trigger a stack-based buffer overflow by providing an excessively long string to the submit-url parameter, which is processed using an unsafe strcpy operation.

Successful exploitation of this flaw can lead to a complete denial of service by crashing the device firmware or web server. More severely, the memory corruption may allow an attacker to hijack the execution flow, potentially leading to arbitrary code execution with root-level privileges. Given the CVSS score of 8.8, this represents a high-risk scenario for organizations relying on these devices for network connectivity.

Immediate Action: Check the D-Link support portal for the latest firmware release for Hardware B1 and apply the update immediately if a patch is available. If no patch is provided by the vendor, restrict access to the device management interface to trusted internal networks only.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual POST requests directed at the /boafrm/formVpnConfigSetup endpoint. Investigate any unexpected reboots or service interruptions occurring on the DWR-M960 units.

Compensating Controls: Implement a Web Application Firewall or network access control list to filter traffic to the management interface. Ensure that the device is not exposed to the public internet to prevent remote exploitation.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the linked research write-up on GitHub.

This vulnerability presents a significant risk to network infrastructure integrity. Organizations using the D-Link DWR-M960 should prioritize identifying affected firmware versions and applying vendor-supplied security updates as soon as they become available. Until remediation is confirmed, isolating the affected hardware from external network access is the most effective way to prevent exploitation.