D-Link DWR-M960: Unsecured Input Can Cause System Crash

Summary

A flaw in the D-Link DWR-M960's software allows an attacker to potentially crash the system by manipulating certain input. This could be done remotely and has already been publicly disclosed, making it a potential risk. Update the software to the latest version to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
dlink	dwr-m960_firmware	1.01.07	–

Original title

A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_427D74 of the file /boafrm/formIpQoS. Executing a manipulation of the argument submit-url can lead to stack-b...

Original description

A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_427D74 of the file /boafrm/formIpQoS. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/LX-66-LX/cve-new/issues/17 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.347177 Permissions Required VDB Entry
https://vuldb.com/?id.347177 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754490 Third Party Advisory VDB Entry
https://www.dlink.com/ Product