CVE-2026-2927
Stack-Based Buffer Overflow in D-Link DWR-M960 Operation Mode Endpoint
Publication date: 2026-02-22
Last updated on: 2026-02-23
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | dwr-m960_firmware | 1.01.07 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2927 is a critical stack-based buffer overflow vulnerability found in the D-Link DWR-M960 router, version 1.01.07. It exists in the function sub_462590 within the Operation Mode Configuration Endpoint, specifically in the file /boafrm/formOpMode.'}, {'type': 'paragraph', 'content': 'The vulnerability arises from improper handling of the "submit-url" argument, where the function uses strcpy to copy this parameter into a fixed-size global buffer without checking if the input length exceeds the buffer size. This lack of bounds checking allows an attacker to supply an oversized submit-url parameter, causing a stack-based buffer overflow.'}, {'type': 'paragraph', 'content': 'This overflow affects local stack variables and can lead to memory corruption. The attack can be initiated remotely without authentication, making it highly severe.'}] [1, 2, 3]
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to several serious impacts on the affected device.
- Denial of Service (DoS): Overwriting critical data or global variables can crash the web server or cause the device to reboot, making it unavailable.
- Arbitrary Code Execution: An attacker can craft payloads to overwrite function pointers or control structures, potentially hijacking the execution flow with root privileges.
Overall, this compromises the confidentiality, integrity, and availability of the device, potentially allowing full device compromise.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending a crafted HTTP POST request to the endpoint /boafrm/formOpMode on the affected D-Link DWR-M960 router firmware version 1.01.07. The request should include the submit-url parameter with an excessively long value to trigger the stack-based buffer overflow.'}, {'type': 'paragraph', 'content': 'A proof-of-concept exploit involves sending such a POST request with valid parameters to pass validation and an oversized submit-url value, which causes the web server to crash or the device to become unreachable.'}, {'type': 'paragraph', 'content': 'To detect the vulnerability on your network or system, you can monitor for crashes or reboots of the device after such requests, or attempt to reproduce the exploit in a controlled environment.'}, {'type': 'list_item', 'content': 'Use curl or similar tools to send a POST request to http://<device-ip>/boafrm/formOpMode with a long submit-url parameter.'}, {'type': 'list_item', 'content': 'Example command: curl -X POST -d "submit-url=$(python3 -c \'print("A"*1000)\')&other_params=valid" http://<device-ip>/boafrm/formOpMode'}, {'type': 'list_item', 'content': "Observe if the device's web server crashes or the device becomes unreachable after the request."}] [3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Currently, there are no known mitigations or countermeasures available for this vulnerability.'}, {'type': 'paragraph', 'content': 'The recommended immediate step is to replace the affected D-Link DWR-M960 device with an alternative product that is not vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, restricting access to the device's management interface from untrusted networks and monitoring for suspicious activity may help reduce risk until replacement."}] [1]