A critical stack-based buffer overflow vulnerability exists in the D-Link DWR-M960 router, posing a significant risk of device compromise or service disruption.

The vulnerability exists in the function sub_460F30 within the /boafrm/formDateReboot endpoint. By providing an oversized input to the submit-url parameter during a save operation, an authenticated attacker can trigger a buffer overflow due to the unsafe use of the strcpy function.

Successful exploitation of this vulnerability allows an attacker to crash the router, resulting in a denial of service for all dependent network traffic. More severely, the memory corruption can be leveraged to achieve arbitrary code execution with root-level privileges, potentially granting the attacker full control over the network gateway. With a CVSS score of 8.8, this flaw represents a high-severity threat to business continuity and internal network security.

Immediate Action: As no official patch is currently available, administrators should restrict access to the device management interface to trusted IP addresses only.

Proactive Monitoring: Monitor device logs for repeated crashes or unusual POST requests directed at the /boafrm/formDateReboot endpoint, which may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or network-level access control to filter or block requests containing excessively long parameters to the vulnerable configuration endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher write-up at the provided GitHub reference.

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a severe risk to affected infrastructure. Organizations using the D-Link DWR-M960 must prioritize isolating the device management interface from untrusted networks immediately. Monitor vendor communication channels closely for the release of a firmware update and apply it as soon as it becomes available to remediate the underlying memory corruption flaw.