CVE-2026-2856
Published: 20 February 2026
Summary
CVE-2026-2856 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2856, published on 2026-02-20, is a stack-based buffer overflow vulnerability affecting the D-Link DWR-M960 router on firmware version 1.01.07. The flaw exists in the sub_424AFC function within the /boafrm/formFilter file of the Filter Configuration Endpoint component. It is triggered by manipulation of the submit-url argument and is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability enables remote exploitation by an attacker with low privileges (PR:L), as indicated by its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction is required, and successful exploitation can lead to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution.
Advisories referenced in VulDB (ctiid.347095, id.347095, submit.754474) and a GitHub issue (LX-66-LX/cve-new/issues/13) provide details on the vulnerability, while the D-Link website (dlink.com) is listed as a source for further information. Security practitioners should review these resources for any available patches or mitigation steps.
The exploit has been made public and could be used, heightening the risk of real-world attacks against affected devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7799
Vulnerability details
A vulnerability was found in D-Link DWR-M960 1.01.07. Affected by this vulnerability is the function sub_424AFC of the file /boafrm/formFilter of the component Filter Configuration Endpoint. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may…
more
be launched remotely. The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the web management interface (formFilter endpoint) of a publicly exposed router allows remote unauthenticated or low-priv RCE; this directly maps to exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires organizations to identify, report, and correct system flaws like this stack-based buffer overflow in a timely manner through patching or updates.
SI-10 mandates validation of information inputs such as the submit-url argument to ensure they do not exceed buffer bounds, directly preventing the buffer overflow.
SI-16 implements memory protection safeguards like stack canaries and ASLR to protect against unauthorized code execution from stack-based buffer overflows.