D-Link DWR-M960: Unauthorized Access via Malicious URL

Summary

A security flaw in the D-Link DWR-M960 device's wireless encryption settings can allow an attacker to access the device remotely if they send a specially crafted URL. This could potentially lead to unauthorized access to the device's settings or the network it's connected to. Users should update their device to the latest firmware version to protect against this vulnerability.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
dlink	dwr-m960_firmware	1.01.07	–

Original title

A vulnerability was found in D-Link DWR-M960 1.01.07. This issue affects the function sub_452CCC of the file /boafrm/formWlEncrypt of the component WLAN Encryption Configuration Endpoint. The manip...

Original description

A vulnerability was found in D-Link DWR-M960 1.01.07. This issue affects the function sub_452CCC of the file /boafrm/formWlEncrypt of the component WLAN Encryption Configuration Endpoint. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/LX-66-LX/cve-new/issues/23 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.347275 Permissions Required VDB Entry
https://vuldb.com/?id.347275 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754500 Third Party Advisory VDB Entry
https://www.dlink.com/ Product