CVE-2026-2856: D-Link DWR-M960 Buffer Overflow Vulnerability

CVE-2026-2856 Overview

CVE-2026-2856 is a stack-based buffer overflow vulnerability affecting the D-Link DWR-M960 router running firmware version 1.01.07. The flaw resides in the sub_424AFC function within the /boafrm/formFilter endpoint, which handles Filter Configuration requests. Attackers can trigger the overflow by manipulating the submit-url argument supplied to the endpoint. The vulnerability is exploitable remotely over the network and requires only low privileges. Public disclosure of the exploit technique increases the likelihood of opportunistic abuse against exposed devices. The issue is classified under [CWE-119] for improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Remote attackers with low-privilege access can corrupt stack memory on affected D-Link DWR-M960 routers, potentially leading to arbitrary code execution or denial of service against the device.

Affected Products

D-Link DWR-M960 router (hardware revision B1)
D-Link DWR-M960 firmware version 1.01.07
Filter Configuration Endpoint exposed via /boafrm/formFilter

Discovery Timeline

2026-02-20 - CVE-2026-2856 published to the National Vulnerability Database
2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2856

Vulnerability Analysis

The vulnerability exists in the embedded web management interface served by the boa HTTP daemon on the DWR-M960. The internal handler sub_424AFC processes form submissions to /boafrm/formFilter, which configures URL and traffic filtering rules. When parsing the submit-url argument, the function copies attacker-supplied data into a fixed-size stack buffer without enforcing length validation. Oversized input overruns the buffer and overwrites adjacent stack frame data, including saved return addresses on the MIPS or ARM stack typically used by D-Link consumer-grade gateways.

Successful exploitation can corrupt control-flow data and yield arbitrary code execution within the context of the web server process, which traditionally runs with elevated privileges on these devices. The result is full compromise of the router, including the ability to pivot into adjacent network segments, intercept traffic, and persist across reboots.

Root Cause

The root cause is the absence of bounds checking on the submit-url parameter before it is written into a stack-allocated buffer inside sub_424AFC. The function relies on unsafe string-copy semantics rather than length-aware alternatives, allowing attacker-controlled input to exceed the buffer's capacity.

Attack Vector

The attack vector is network-based against the device's web administration interface. An authenticated attacker with low-privilege credentials submits a crafted HTTP POST request to /boafrm/formFilter with an oversized submit-url value. Routers exposing the management interface to the WAN or to untrusted LAN segments are at the highest risk.

No verified exploit code is published in the referenced advisories. See the GitHub Issue Report and VulDB entry #347095 for additional technical context.

Detection Methods for CVE-2026-2856

Indicators of Compromise

HTTP POST requests to /boafrm/formFilter containing abnormally long submit-url parameter values
Unexpected reboots, watchdog resets, or crashes of the boa web server process on DWR-M960 devices
New or modified filter rules in the device configuration that were not initiated by an administrator
Outbound connections from the router management plane to unknown remote hosts following a configuration request

Detection Strategies

Inspect HTTP request bodies destined for the router management interface and alert on submit-url payloads exceeding expected URL length thresholds
Correlate authenticated administrative sessions with subsequent device instability or service restarts
Apply signatures for repeated POST requests to /boafrm/formFilter originating from a single source within short time windows

Monitoring Recommendations

Forward router syslog data to a centralized SIEM and alert on boa process termination or unexpected restarts
Monitor administrative authentication events on the DWR-M960 and flag logins from atypical geolocations or networks
Track configuration baselines for filter rules and alert on drift between snapshots

How to Mitigate CVE-2026-2856

Immediate Actions Required

Disable remote (WAN-side) access to the DWR-M960 web management interface and restrict administration to a trusted management VLAN
Rotate all administrative credentials on affected devices to limit the value of compromised low-privilege accounts
Audit the device's current filter configuration for unauthorized entries and reset to a known-good state if tampering is suspected

Patch Information

At the time of publication, no vendor advisory or firmware update addressing CVE-2026-2856 has been referenced in the NVD entry. Consult the D-Link Homepage and the regional D-Link support portal for the latest firmware availability for the DWR-M960.

Workarounds

Place the DWR-M960 management interface behind a network access control list that permits only specific administrator IP addresses
Segment the router from sensitive internal networks until a vendor patch is available
Where feasible, replace internet-facing DWR-M960 units with a supported model that receives active security maintenance

bash

# Example: restrict management access to a single admin host using an upstream firewall
# Replace 198.51.100.10 with the authorized administrator IP
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s 198.51.100.10 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s 198.51.100.10 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP