A stack-based buffer overflow exists in the VPN Configuration Endpoint function sub_4196C4 within the D-Link DWR‑M960 firmware. The flaw is triggered by manipulating the submit‑url argument, allowing an attacker to overflow the stack and potentially execute arbitrary code on the device. The description states the attack can be carried out remotely and the vulnerability has been publicly disclosed with the potential for exploitation. The vulnerability is a classic stack corruption as indicated by CWE‑119 and CWE‑121.

The issue affects the D-Link DWR‑M960 router with firmware version 1.01.07. Only this specific firmware revision is known to contain the unpatched buffer overflow; newer or older firmware might not be vulnerable, but the current version must be updated to a patched release.

The CVSS score of 8.7 reflects high severity, and the EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation observed at the time of analysis. The intrusion is possible over the network, implying remote attackers can trigger the overflow. Although the vulnerability is not listed in the CISA KEV catalog, its nature and the public disclosure suggest a real, though low‑frequency, risk. If exploited, the attacker would gain full control over the device, compromising confidentiality, integrity, and availability of the network.