The vulnerability resides in the Port Forwarding Configuration Endpoint of the D-Link DWR-M960, specifically in the sub_423E00 function within /boafrm/formPortFw. By manipulating the submit‑url argument, an attacker can trigger a stack-based buffer overflow, enabling arbitrary code execution from a remote location. The flaw exploits improper boundary checks and results in loss of control over the execution flow.

All D-Link DWR-M960 devices running firmware version 1.01.07 are affected. The issue is confined to the Port Forwarding Configuration endpoint of the web management interface.

The vulnerability carries a CVSS score of 8.7, indicating a high severity level. Although the EPSS score is below 1%, meaning the probability of exploitation is low at this time, the flaw has been publicly disclosed and can be used remotely, typically via the web administration interface. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would need network access to the device’s management interface, and because the CVE description does not mention authentication requirements, it is inferred that authentication may not be necessary; however, this inference is not explicitly confirmed.