An improperly validated argument, submit-url, in the sub_469104 function of /boafrm/formIpv6Setup triggers a stack-based buffer overflow. The flaw can be triggered remotely by sending crafted inputs, potentially allowing an attacker to overwrite the stack and execute arbitrary code on the D‑Link DWR‑M960 device. This creates a risk of full system compromise or persistent foothold as the overflow can lead to code execution or denial of service.

The vulnerability affects D‑Link DWR‑M960 routers running firmware version 1.01.07. The problem resides in the formIpv6Setup handling within that firmware build. All devices operating this specific firmware revision are exposed; other firmware revisions have not been confirmed as vulnerable.

The flaw carries a CVSS score of 8.7, indicating high severity. The EPSS score is listed as less than 1 %, suggesting a low likelihood of widespread exploitation so far, yet a public exploit has been released, and the attack can be performed from a remote network by manipulating the submit-url parameter. While the vulnerability is not recorded in the CISA KEV catalog, its potential for remote code execution, combined with the availability of a public exploit, means that it should be treated with high priority and mitigated promptly.