The flaw is a stack‑based buffer overflow triggered by manipulating the "submit-url" parameter in the NTP configuration endpoint. An attacker can send a crafted HTTP request to the /boafrm/formNtp page from a remote host, causing the stack to corrupt and potentially allowing execution of arbitrary code on the device. This vulnerability is classified under CWE‑119 and CWE‑121 and could give an attacker full control of the router.

The vulnerability affects D‑Link DWR‑M960 routers running firmware version 1.01.07. The problematic code resides in the web interface component that handles NTP configuration. All units of this model with the specified firmware version are susceptible until a patch is applied or the feature is disabled.

With a CVSS score of 8.7 it is classified as high severity. The EPSS score is reported as less than 1 %, indicating a low likelihood of exploitation at present, and the vulnerability is not in the CISA KEV catalog. Nevertheless, an exploit has been released and can be leveraged remotely through the web interface. The stack overflow could lead to crashes or, if the attacker successfully gains control, arbitrary code execution, giving full device compromise. The attack vector is remote via HTTP to the vulnerable endpoint, hence any host that can reach the router’s management interface is a potential threat.