CVE-2026-2929: D-Link DWR-M960 Buffer Overflow Vulnerability

CVE-2026-2929 Overview

A stack-based buffer overflow vulnerability has been identified in the D-Link DWR-M960 wireless router running firmware version 1.01.07. The vulnerability exists within the function sub_453140 of the file /boafrm/formWlAc, which is part of the Wireless Access Control Endpoint component. Through manipulation of the submit-url argument, an authenticated attacker can trigger a stack-based buffer overflow condition that may lead to remote code execution or denial of service.

Critical Impact

Remote exploitation is possible, and the exploit has been publicly disclosed. Attackers with low privileges can potentially execute arbitrary code or crash affected devices, compromising network security and availability.

Affected Products

• D-Link DWR-M960 Firmware version 1.01.07
• D-Link DWR-M960 Hardware Revision B1
• D-Link DWR-M960 series routers with vulnerable firmware

Discovery Timeline

• 2026-02-22 - CVE-2026-2929 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2929

Vulnerability Analysis

This vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw occurs in the Wireless Access Control Endpoint component of the D-Link DWR-M960 router. When processing requests to /boafrm/formWlAc, the sub_453140 function fails to properly validate the length of input supplied through the submit-url parameter before copying it to a stack-allocated buffer. This insufficient boundary checking allows an attacker to overwrite adjacent memory on the stack, potentially including return addresses and saved registers.

The network-accessible nature of this vulnerability makes it particularly concerning for organizations deploying these devices. An attacker with low-level authentication can craft malicious requests to the affected endpoint, triggering the buffer overflow condition remotely. The vulnerability does not require any user interaction, making it suitable for automated exploitation attempts.

Root Cause

The root cause of CVE-2026-2929 is improper input validation in the sub_453140 function within the /boafrm/formWlAc endpoint. The function does not adequately check the size of the submit-url parameter before copying its contents to a fixed-size stack buffer. This classic buffer overflow pattern allows data to exceed the allocated buffer boundaries, corrupting adjacent stack memory. The lack of modern memory protection mechanisms in embedded router firmware exacerbates the exploitability of this vulnerability.

Attack Vector

The attack vector for this vulnerability is network-based. An authenticated attacker can send specially crafted HTTP requests to the /boafrm/formWlAc endpoint with an oversized submit-url parameter value. The exploitation flow involves:

1. The attacker authenticates to the router's web management interface with low-privilege credentials
2. A malicious HTTP POST request is sent to /boafrm/formWlAc containing an oversized submit-url parameter
3. The vulnerable sub_453140 function processes the request and copies the parameter value to a stack buffer without proper bounds checking
4. The oversized input overwrites adjacent stack memory, potentially including the return address
5. Upon function return, control flow may be redirected to attacker-controlled code

The exploit has been publicly disclosed, increasing the risk of active exploitation. For technical details, refer to the GitHub Issue Discussion and VulDB entry.

Detection Methods for CVE-2026-2929

Indicators of Compromise

• Unusual HTTP POST requests to /boafrm/formWlAc endpoint with abnormally large submit-url parameter values
• Router crashes or unexpected reboots, particularly after web interface access
• Anomalous outbound network connections from the router device
• Modified router configurations or new unauthorized administrative accounts

Detection Strategies

• Deploy network intrusion detection systems (NIDS) with signatures to detect oversized HTTP parameters targeting D-Link router endpoints
• Implement web application firewall rules to block requests with excessively long submit-url values to /boafrm/formWlAc
• Monitor router system logs for evidence of crashes or memory corruption errors
• Use firmware integrity verification tools to detect unauthorized modifications to router software

Monitoring Recommendations

• Enable logging on D-Link DWR-M960 devices and forward logs to a centralized SIEM for analysis
• Establish baseline behavior for router management interface access and alert on deviations
• Monitor network traffic patterns for suspicious activity originating from or destined to affected devices
• Implement regular firmware integrity checks to detect post-exploitation modifications

How to Mitigate CVE-2026-2929

Immediate Actions Required

• Restrict access to the router's web management interface to trusted IP addresses only
• Disable remote management features if not required for operations
• Implement network segmentation to isolate vulnerable devices from untrusted network segments
• Monitor the D-Link Official Website for firmware updates addressing this vulnerability

Patch Information

As of the last update on 2026-02-23, no vendor patch has been publicly announced for CVE-2026-2929. Organizations should monitor D-Link's security advisories and official website for firmware updates. Given the public disclosure of exploit details, applying patches immediately upon release is critical. Consider replacing end-of-life devices if D-Link does not provide a security update.

Workarounds

• Configure firewall rules to restrict access to port 80/443 on the router's management interface from untrusted networks
• Disable the Wireless Access Control web interface if the feature is not required
• Use VPN tunnels for any necessary remote management access
• Consider deploying a third-party firewall or access control device in front of vulnerable routers

# Example iptables rules to restrict management interface access
# Run these commands on an upstream firewall protecting the D-Link device

# Allow management access only from trusted admin subnet
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -s <ADMIN_SUBNET> -j ACCEPT
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -s <ADMIN_SUBNET> -j ACCEPT

# Block all other management traffic to the router
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -j DROP