The vulnerability resides in the sub_452CCC function of the WLAN Encryption Configuration Endpoint (formWlEncrypt) on D-Link DWR‑M960 routers. A crafted submit‑url parameter can overflow a local stack buffer, allowing the attacker to overwrite control data, and if successfully exploited, the attacker can achieve arbitrary code execution on the device, compromising confidentiality, integrity, and availability.

Affected devices are D-Link DWR‑M960 routers running firmware 1.01.07. The manufacturer is D-Link. No additional versions are specified, so any fleet of this model with the affected firmware is vulnerable.

The CVSS base score of 8.7 reflects a high severity. The EPSS score indicates a very low current exploitation probability (<1%), and the vulnerability is not yet listed in CISA’s KEV catalog. Nevertheless, the exploit is publicly available, and because the attack vector is remote, the potential impact is significant. Successful exploitation would give the attacker full control over the router, enabling network compromise or further lateral movement.