CVE-2026-2960
📋 TL;DR
A stack-based buffer overflow vulnerability in D-Link DWR-M960 routers allows remote attackers to execute arbitrary code by manipulating the submit-url parameter. This affects D-Link DWR-M960 version 1.01.07. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- D-Link DWR-M960
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Remote code execution allowing attacker to modify router settings, intercept traffic, or use the device as part of a botnet.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploit details have been published on GitHub and vulnerability databases, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dlink.com/
Restart Required: Yes
Instructions:
1. Check D-Link website for firmware updates 2. Download latest firmware 3. Upload via router admin interface 4. Reboot router
🔧 Temporary Workarounds
Disable WAN access to admin interface
allBlock external access to router administration interface
Configure firewall to block WAN access to port 80/443 on router
Disable DHCPv6 if not needed
allTurn off DHCPv6 functionality to remove attack surface
Login to router admin > Network Settings > Disable DHCPv6
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for unusual traffic patterns from router
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.01.07, device is vulnerable.Check Version:
Login to router admin interface and check System Information or Firmware VersionVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.01.07📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /boafrm/formDhcpv6s with long submit-url parameters
- Router reboot events
- Configuration changes without authorized user
Network Indicators:
- Unusual outbound connections from router
- Traffic spikes from router to unknown destinations
- DHCPv6 configuration changes
SIEM Query:
source="router_logs" AND (uri="/boafrm/formDhcpv6s" AND data_length>1000) OR event="firmware_change"