A stack‑based buffer overflow exists in the Scheduled Reboot Configuration Endpoint of the D‑Link DWR‑M960 router firmware 1.01.07. The function sub_460F30 in the /boafrm/formDateReboot component is vulnerable when an attacker manipulates the submit‑url argument, allowing a crafted request to overflow a stack buffer. This flaw can lead to execution of arbitrary code on the device and is classified in the CWE set 119 and 121.

All units running D‑Link DWR‑M960 router models with firmware version 1.01.07 are affected. No other firmware revisions or nearby product lines are identified as vulnerable within the supplied information.

The vulnerability carries a CVSS score of 8.7, indicating high severity, but the EPSS score is less than 1 %, suggesting a low current exploit probability. It is not listed in the KEV catalog. The endpoint is remotely accessible, meaning an attacker can trigger the overflow from outside the local network if the device is reachable. Publicly available exploits have been documented, increasing the likelihood that a determined adversary may target affected devices.