D-Link DWR-M960: Remote Attack through LTE Configuration Setting

Summary

A security issue exists in the D-Link DWR-M960's LTE configuration settings. An attacker can potentially exploit this vulnerability to remotely take control of the device. To protect your device, update to the latest software version available.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
dlink	dwr-m960_firmware	1.01.07	–

Original title

A flaw has been found in D-Link DWR-M960 1.01.07. This affects the function sub_4237AC of the file /boafrm/formLteSetup of the component LTE Configuration Endpoint. Executing a manipulation of the ...

Original description

A flaw has been found in D-Link DWR-M960 1.01.07. This affects the function sub_4237AC of the file /boafrm/formLteSetup of the component LTE Configuration Endpoint. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/LX-66-LX/cve-new/issues/21 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.347273 Permissions Required VDB Entry
https://vuldb.com/?id.347273 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754498 Third Party Advisory VDB Entry
https://www.dlink.com/ Product