CVE-2026-2884
Published: 21 February 2026
Summary
CVE-2026-2884 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validating inputs such as the submit-url argument to prevent stack-based buffer overflows from improper restriction of operations within memory bounds.
SI-16 enforces memory protections like stack canaries, address space layout randomization, and non-executable stacks to mitigate exploitation of stack-based buffer overflows.
SI-2 mandates timely identification, reporting, and remediation of flaws like CVE-2026-2884 through firmware patching to eliminate the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in remotely accessible web form handler (WAN config) with PR:L auth required directly enables T1190 (exploit public-facing application) for initial/remote access and T1068 (exploitation for privilege escalation) to achieve arbitrary code execution from low-priv context.
NVD Description
A vulnerability was identified in D-Link DWR-M960 1.01.07. The affected element is the function sub_41914C of the file /boafrm/formWanConfigSetup of the component WAN Interface Setting Handler. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack is…
more
possible to be carried out remotely. The exploit is publicly available and might be used.
Deeper analysisAI
CVE-2026-2884 is a stack-based buffer overflow vulnerability affecting the D-Link DWR-M960 router on firmware version 1.01.07. The flaw exists in the sub_41914C function within the /boafrm/formWanConfigSetup file of the WAN Interface Setting Handler component. It is triggered by manipulation of the submit-url argument and was published on 2026-02-21. The issue is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability enables remote exploitation by attackers with low privileges (PR:L), as indicated by its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction is required, and successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device. A public exploit is available and might be used.
Advisories and additional details are documented in references such as the GitHub issue at https://github.com/LX-66-LX/cve-new/issues/18, VulDB entries at https://vuldb.com/?ctiid.347178, https://vuldb.com/?id.347178, and https://vuldb.com/?submit.754493, as well as the D-Link website at https://www.dlink.com/.
Details
- CWE(s)