A critical buffer overflow vulnerability in D-Link DWR-M961 routers permits unauthenticated remote code execution via the app.cgi interface.

This is a classic buffer overflow (CWE-120) in the app.cgi interface. By sending an excessively long string to the netAcc.addlist[].name field, an unauthenticated attacker can overwrite memory to execute arbitrary code or trigger a system crash.

With a CVSS score of 9.8, this vulnerability represents a critical risk to network security. Successful exploitation grants an attacker the ability to execute arbitrary code, potentially leading to full control over the router, data exfiltration, or complete network disruption.

Immediate Action: Apply the firmware update to version 1.1.5_C1_202607071108 or newer to address the underlying memory safety issue.

Proactive Monitoring: Review system logs for signs of repeated crashes or abnormal process termination, which may indicate attempted exploitation.

Compensating Controls: Implement strict ingress filtering at the network perimeter to prevent unauthorized access to the router's management web interface.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate remediation. Administrators should verify the current firmware version and apply the vendor-provided patch as soon as possible to prevent potential remote exploitation.