Buffer Overflow in D-Link DWR-M961 Firmware

Executive Summary

This is a buffer overflow vulnerability in D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044. It exists in the app.cgi interface where a remote attacker can send an overly long string to the netAcc.addlist[].name field. This allows executing arbitrary commands or crashing the device.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, scan for D-Link DWR-M961 devices with hardware version C1 and software versions prior to 1.1.5_C1_202607071108. Check the app.cgi interface for buffer overflow attempts by sending a long string to the netAcc.addlist[].name field and monitoring for crashes or unexpected behavior.

Use network scanning tools like Nmap to identify affected devices. Example command: nmap -p 80 --script http-vuln-cve2026-71957 <target_IP>. Test the vulnerability by sending a crafted payload to the app.cgi endpoint and observing responses.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run malicious commands on your device, potentially gaining control over it. This might lead to unauthorized access, data theft, or disruption of device functionality. The device could also become unresponsive or crash entirely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to its high severity (CVSS 9.3) and the risk of arbitrary command execution. A remote attacker could exploit it to gain unauthorized access to sensitive data, which is a direct violation of data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the D-Link DWR-M961 device to software version 1.1.5_C1_202607071108 or later to patch the buffer overflow vulnerability. If updating is not possible, isolate the device from untrusted networks to prevent remote exploitation.

Disable the app.cgi interface if it is not required for operation. Implement network-level controls such as firewalls to restrict access to the device's web interface from unauthorized sources.

Useful 0 Not Useful 0