D-Link DWR-M960 Router Can Be Hacked Remotely

Summary

A bug in the D-Link DWR-M960 router can allow an attacker to take control of the device remotely. This can happen if a hacker sends a specific type of data to the router. To protect your network, update the router's firmware to the latest version available.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
dlink	dwr-m960_firmware	1.01.07	–

Original title

A vulnerability was found in D-Link DWR-M960 1.01.07. This issue affects the function sub_46385C of the file /boafrm/formDosCfg. Performing a manipulation of the argument submit-url results in stac...

Original description

A vulnerability was found in D-Link DWR-M960 1.01.07. This issue affects the function sub_46385C of the file /boafrm/formDosCfg. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/LX-66-LX/cve-new/issues/16 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.347176 Permissions Required VDB Entry
https://vuldb.com/?id.347176 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754487 Third Party Advisory VDB Entry
https://www.dlink.com/ Product