CVE-2026-2885: D-Link DWR-M960 Buffer Overflow Flaw

CVE-2026-2885 Overview

CVE-2026-2885 is a stack-based buffer overflow vulnerability in the D-Link DWR-M960 router running firmware version 1.01.07. The flaw resides in the sub_469104 function within the /boafrm/formIpv6Setup endpoint. Attackers can trigger the overflow by manipulating the submit-url argument, corrupting stack memory on the device. The vulnerability is remotely exploitable across the network and is classified under [CWE-119] for improper restriction of operations within memory bounds. Public disclosure indicates that exploit code has been released, increasing the operational risk for exposed devices.

Critical Impact

Remote attackers with low-privileged access can corrupt stack memory on D-Link DWR-M960 routers, potentially leading to arbitrary code execution or device compromise.

Affected Products

• D-Link DWR-M960 router (hardware revision B1)
• D-Link DWR-M960 firmware version 1.01.07
• Deployments exposing the /boafrm/formIpv6Setup web interface

Discovery Timeline

• 2026-02-21 - CVE-2026-2885 published to the National Vulnerability Database
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2885

Vulnerability Analysis

The vulnerability resides in the sub_469104 function inside the boa web server binary that powers the DWR-M960 management interface. When processing requests to /boafrm/formIpv6Setup, the function reads the submit-url HTTP parameter into a fixed-size stack buffer without validating its length. An attacker supplying an oversized value overruns the buffer, overwriting adjacent stack data, saved registers, and the return address. Successful exploitation can redirect execution flow and lead to arbitrary code execution under the privilege of the embedded web server process. Public disclosure references on VulDB entry #347179 and the GitHub issue discussion confirm a working exploit has been released.

Root Cause

The root cause is missing length validation on user-controlled input. The submit-url parameter is copied into a stack-allocated buffer using an unbounded string operation. This pattern, common in MIPS-based embedded boa-derived web servers, allows attackers to overwrite the return address and pivot execution into attacker-controlled data.

Attack Vector

Exploitation requires network reachability to the device's HTTP management interface and low-privileged authentication. An attacker submits a crafted HTTP POST request to /boafrm/formIpv6Setup with an oversized submit-url parameter. Devices exposing the administrative interface to the WAN or accessible from compromised LAN hosts are at the highest risk.

No verified proof-of-concept code is reproduced here. Technical details are available in the VulDB CTI entry #347179 and the public issue tracker.

Detection Methods for CVE-2026-2885

Indicators of Compromise

• HTTP POST requests to /boafrm/formIpv6Setup containing abnormally long submit-url parameter values
• Unexpected reboots, web service crashes, or watchdog resets on DWR-M960 devices
• Outbound connections from the router to unknown infrastructure following web interface activity
• New or modified processes spawned by the boa web server

Detection Strategies

• Inspect HTTP traffic destined for the router management interface and flag submit-url values exceeding expected URL length boundaries
• Deploy network IDS signatures that match POST requests to /boafrm/formIpv6Setup with payloads containing non-printable bytes or shellcode patterns
• Correlate router crash logs with preceding HTTP requests to identify exploitation attempts

Monitoring Recommendations

• Restrict and log all access to the DWR-M960 administrative interface from both WAN and LAN segments
• Forward router syslog data to a centralized SIEM for behavioral baselining and anomaly identification
• Alert on authentication events to the router web UI from atypical source addresses or at unusual hours

How to Mitigate CVE-2026-2885

Immediate Actions Required

• Disable remote (WAN-side) management of the DWR-M960 web interface until a vendor patch is available
• Restrict LAN access to /boafrm/formIpv6Setup to a small set of trusted administrative hosts
• Change default administrative credentials and enforce strong passwords to reduce the low-privilege attack surface
• Monitor D-Link Security Resources for firmware updates addressing CVE-2026-2885

Patch Information

At the time of publication, no fixed firmware version has been published by D-Link for the DWR-M960 running 1.01.07. Administrators should track vendor advisories and apply firmware updates immediately upon release. The DWR-M960 is positioned for emerging-market deployments, and end-of-life status should be verified directly with D-Link.

Workarounds

• Place the router management interface behind a VPN or jump host instead of exposing it directly
• Apply ACLs on upstream network equipment to block inbound HTTP/HTTPS traffic to the router from untrusted networks
• Segment the management VLAN from general user traffic to limit lateral exposure
• Consider replacing affected units with supported hardware where firmware fixes are not forthcoming

# Example iptables rule to restrict access to the router web interface
# Allow only a trusted management subnet to reach the router on TCP/80 and TCP/443
iptables -A FORWARD -s 10.10.10.0/24 -d <router_ip> -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A FORWARD -d <router_ip> -p tcp -m multiport --dports 80,443 -j DROP