D-Link DWR-M960: Unsecured Wireless Access Can Be Hacked Remotely

Summary

A security flaw in the D-Link DWR-M960's wireless control system allows an attacker to potentially take control of the device from a remote location. This could lead to unauthorized access and disruption of the network. Users should update to a fixed version of the software as soon as possible.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
dlink	dwr-m960_firmware	1.01.07	–

Original title

A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_453140 of the file /boafrm/formWlAc of the component Wireless Access Control Endpoint. This manipulation of t...

Original description

A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_453140 of the file /boafrm/formWlAc of the component Wireless Access Control Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/LX-66-LX/cve-new/issues/24 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.347276 Permissions Required VDB Entry
https://vuldb.com/?id.347276 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754503 Third Party Advisory VDB Entry
https://www.dlink.com/ Product