D-Link DWR-M960: Unsecured Function Can Cause Remote Crashes

Summary

A security flaw in the D-Link DWR-M960 router can be exploited remotely, potentially causing the system to crash. This flaw is caused by a manipulation of the 'submit-url' argument in a specific function. To protect your network, update your DWR-M960 router to the latest available firmware.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
dlink	dwr-m960_firmware	1.01.07	–

Original title

A flaw has been found in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_468D64 of the file /boafrm/formDhcpv6s. Executing a manipulation of the argument submit-url can lead to ...

Original description

A flaw has been found in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_468D64 of the file /boafrm/formDhcpv6s. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.

nvd CVSS2.0 9.0

nvd CVSS3.1 8.8

nvd CVSS4.0 7.4

Vulnerability type

CWE-119 Buffer Overflow

CWE-121 Stack-based Buffer Overflow

https://github.com/LX-66-LX/cve-new/issues/27 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.347327 Permissions Required VDB Entry
https://vuldb.com/?id.347327 Third Party Advisory VDB Entry
https://vuldb.com/?submit.754512 Third Party Advisory VDB Entry
https://www.dlink.com/ Product