CVE-2026-2853
Published: 20 February 2026
Summary
CVE-2026-2853 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 46.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2853 is a stack-based buffer overflow vulnerability affecting the D-Link DWR-M960 router on firmware version 1.01.07. The flaw resides in the sub_462E14 function within the /boafrm/formSysLog file of the System Log Configuration Endpoint, triggered by manipulation of the submit-url argument. Published on 2026-02-20, it is associated with CWE-119 and CWE-121, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially leading to full system control on the affected device. The exploit is public and available for use.
Advisories from VulDB (ctiid.347092, id.347092, submit.754456) and a GitHub issue (LX-66-LX/cve-new/issues/10) document the vulnerability, while the D-Link website (dlink.com) is referenced as a vendor resource. No specific patch or mitigation details are outlined in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8373
Vulnerability details
A vulnerability was detected in D-Link DWR-M960 1.01.07. This affects the function sub_462E14 of the file /boafrm/formSysLog of the component System Log Configuration Endpoint. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be…
more
initiated remotely. The exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in authenticated web endpoint (/boafrm/formSysLog) directly enables remote code execution on a public-facing network device, mapping to T1190 for initial access and T1068 for escalation from low-privileged web access to full system compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack-based buffer overflows by validating and sanitizing the manipulated submit-url argument in the System Log Configuration Endpoint.
Implements memory safeguards such as stack canaries, ASLR, and non-executable stacks to block successful exploitation of the buffer overflow vulnerability.
Requires timely identification, reporting, and patching of known flaws like CVE-2026-2853 to eliminate the vulnerability from the D-Link DWR-M960 firmware.