Description
A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_453140 of the file /boafrm/formWlAc of the component Wireless Access Control Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Published: 2026-02-22
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch ASAP
AI Analysis

Impact

A stack‑based buffer overflow exists in the Wireless Access Control Endpoint of D‑Link DWR‑M960 firmware 1.01.07. By manipulating the submit‑url argument, an attacker can overflow a buffer in the sub_453140 routine, allowing arbitrary code execution from a remote host. This vulnerability is scored high on CVSS (8.7) and is listed under CWE‑119 and CWE‑121, indicating unchecked input handling and stack corruption.

Affected Systems

The affected system is D‑Link DWR‑M960 wireless router running firmware version 1.01.07. No other versions or models are mentioned in the CNA data.

Risk and Exploitability

The CVSS base score of 8.7 classifies this flaw as high severity; however, the EPSS score is reported as less than 1 %, implying a low probability of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog, and no official patch or workaround is referenced. Remote exploitation is possible via the publicly accessible web interface, and because the exploit has been disclosed, a determined attacker could leverage it if the device remains unpatched and reachable over the network.

Generated by OpenCVE AI on April 16, 2026 at 16:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update that addresses the buffer overflow in the Wireless Access Control Endpoint.
  • If no patch is immediately available, restrict access to the device’s web interface by disabling remote management or configuring firewall rules to allow only trusted IP addresses.
  • Monitor the device for anomalous network traffic and investigate any unexpected outbound connections.

Generated by OpenCVE AI on April 16, 2026 at 16:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 27 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 23 Feb 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dwr-m960
Dlink dwr-m960 Firmware
CPEs cpe:2.3:h:dlink:dwr-m960:b1:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dwr-m960_firmware:1.01.07:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dwr-m960
Dlink dwr-m960 Firmware

Mon, 23 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dwr-m960
Vendors & Products D-link
D-link dwr-m960

Sun, 22 Feb 2026 05:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_453140 of the file /boafrm/formWlAc of the component Wireless Access Control Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Title D-Link DWR-M960 Wireless Access Control Endpoint formWlAc sub_453140 stack-based overflow
Weaknesses CWE-119
CWE-121
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

D-link Dwr-m960
Dlink Dwr-m960 Dwr-m960 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-27T18:13:14.266Z

Reserved: 2026-02-21T04:58:40.332Z

Link: CVE-2026-2929

cve-icon Vulnrichment

Updated: 2026-02-27T18:13:09.296Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-22T06:16:03.873

Modified: 2026-02-23T19:39:25.350

Link: CVE-2026-2929

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T16:45:25Z

Weaknesses