CVE-2026-2962
📋 TL;DR
A remote stack-based buffer overflow vulnerability exists in D-Link DWR-M960 routers through the Scheduled Reboot Configuration endpoint. Attackers can exploit this to execute arbitrary code or cause denial of service. All users of affected DWR-M960 routers with vulnerable firmware are at risk.
💻 Affected Systems
- D-Link DWR-M960
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, and persistent backdoor installation.
Likely Case
Device crash/reboot causing denial of service, potentially followed by remote code execution for network persistence.
If Mitigated
Limited to denial of service if exploit fails or execution is constrained by security controls.
🎯 Exploit Status
Public exploit available on GitHub. Remote exploitation requires sending crafted HTTP request to /boafrm/formDateReboot endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dlink.com/
Restart Required: Yes
Instructions:
1. Check D-Link website for firmware updates. 2. Download latest firmware. 3. Upload via web interface. 4. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to web management interface
Access router admin > Remote Management > Disable
Network Segmentation
allIsolate router management interface from untrusted networks
Configure firewall rules to restrict access to router IP on ports 80/443
🧯 If You Can't Patch
- Replace vulnerable device with supported model
- Implement strict network access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface. If version is 1.01.07 or earlier, device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i firmwareVerify Fix Applied:
Verify firmware version is updated beyond 1.01.07. Test endpoint with safe payload to confirm overflow is patched.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /boafrm/formDateReboot with long submit-url parameter
- Router crash/reboot logs
- Unusual process execution
Network Indicators:
- HTTP POST to /boafrm/formDateReboot with oversized payload
- Sudden router reboot traffic patterns
SIEM Query:
source="router-logs" AND uri="/boafrm/formDateReboot" AND content_length>1000