CVE-2026-2857
Stack-Based Buffer Overflow in D-Link DWR-M960 Port Forwarding
Publication date: 2026-02-20
Last updated on: 2026-02-23
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dwr-m960_firmware | 1.01.07 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2857 is a stack-based buffer overflow vulnerability in the D-Link DWR-M960 router, firmware version 1.01.07. It exists in the Port Forwarding Configuration Endpoint, specifically in the function sub_423E00 of the file /boafrm/formPortFw.'}, {'type': 'paragraph', 'content': "The vulnerability occurs because the function uses the unsafe strcpy function to copy the user-controlled 'submit-url' parameter into a fixed-size global buffer named wizard_htm without checking the length of the input. This allows an attacker to supply an excessively long 'submit-url' value, causing a buffer overflow that overwrites adjacent memory."}, {'type': 'paragraph', 'content': "Remote attackers can exploit this vulnerability by sending a specially crafted POST request to the /boafrm/formPortFw endpoint with the 'save_apply' parameter and an oversized 'submit-url' value, triggering the overflow."}] [1, 2, 3]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "Exploitation of this vulnerability can lead to denial of service (DoS) by crashing the router's web server or causing device reboots, making the device unreachable."}, {'type': 'paragraph', 'content': 'More critically, it may allow an attacker to execute arbitrary code on the device with root privileges by overwriting function pointers or control structures in memory.'}, {'type': 'paragraph', 'content': 'This means an attacker could potentially take full control of the affected router remotely without authentication.'}] [1, 2, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious POST requests to the endpoint /boafrm/formPortFw on the D-Link DWR-M960 router running firmware version 1.01.07. Specifically, look for HTTP POST requests containing the parameter save_apply along with an unusually long submit-url parameter, which is used to trigger the buffer overflow.'}, {'type': 'paragraph', 'content': 'A proof of concept involves sending a POST request with an excessively long submit-url value to this endpoint, which causes the device to crash or reboot.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts on your network or system, you can use network monitoring tools or packet capture utilities (such as tcpdump or Wireshark) to filter HTTP POST requests targeting /boafrm/formPortFw with the save_apply parameter.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture suspicious POST requests: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'POST /boafrm/formPortFw'"}, {'type': 'list_item', 'content': 'Use curl or similar tools to test the endpoint manually by sending a crafted POST request with a long submit-url parameter to check if the device responds abnormally or crashes.'}] [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint /boafrm/formPortFw by limiting network exposure of the D-Link DWR-M960 router, such as placing it behind a firewall or disabling remote management features.
Since no official vendor patch or fix has been reported, it is recommended to replace the affected device with an alternative product that is not vulnerable.
Additionally, monitor the device for signs of exploitation such as unexpected crashes, reboots, or abnormal behavior, and consider disabling the Port Forwarding configuration feature if possible.