The vulnerability is a stack‑based buffer overflow in the sub_427D74 function of /boafrm/formIpQoS, triggered by manipulating the submit‑url parameter. This flaw allows an attacker who can send a crafted request to the device to overwrite memory on the stack, potentially gaining execution control. The bug is mapped to buffer overflow and stack memory corruption weaknesses, enabling remote code execution and compromise of the device’s integrity and availability.

D‑Link DWR‑M960 routers running firmware version 1.01.07 are affected. The issue resides specifically within the formIpQoS handler of the HTTP interface. No other firmware versions are listed as impacted. Devices that expose this interface to remote networks are at risk.

The CVSS base score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog, but it has been publicly disclosed and the exploit is available. Attackers can reach the vulnerable function remotely via the network, making the risk significant for devices exposed to the internet. With a stack buffer overflow, the exploitation demands only a crafted HTTP request and no privileged user interaction, hence the risk remains high despite the low exploitation probability.