Cyber Posture

CVE-2026-2884

HighPublic PoC

Published: 21 February 2026

Published
21 February 2026
Modified
23 February 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 4.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2884 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 requires validating inputs such as the submit-url argument to prevent stack-based buffer overflows from improper restriction of operations within memory bounds.

prevent

SI-16 enforces memory protections like stack canaries, address space layout randomization, and non-executable stacks to mitigate exploitation of stack-based buffer overflows.

prevent

SI-2 mandates timely identification, reporting, and remediation of flaws like CVE-2026-2884 through firmware patching to eliminate the buffer overflow vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Stack-based buffer overflow in remotely accessible web form handler (WAN config) with PR:L auth required directly enables T1190 (exploit public-facing application) for initial/remote access and T1068 (exploitation for privilege escalation) to achieve arbitrary code execution from low-priv context.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was identified in D-Link DWR-M960 1.01.07. The affected element is the function sub_41914C of the file /boafrm/formWanConfigSetup of the component WAN Interface Setting Handler. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack is…

more

possible to be carried out remotely. The exploit is publicly available and might be used.

Deeper analysisAI

CVE-2026-2884 is a stack-based buffer overflow vulnerability affecting the D-Link DWR-M960 router on firmware version 1.01.07. The flaw exists in the sub_41914C function within the /boafrm/formWanConfigSetup file of the WAN Interface Setting Handler component. It is triggered by manipulation of the submit-url argument and was published on 2026-02-21. The issue is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).

The vulnerability enables remote exploitation by attackers with low privileges (PR:L), as indicated by its CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction is required, and successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution on the affected device. A public exploit is available and might be used.

Advisories and additional details are documented in references such as the GitHub issue at https://github.com/LX-66-LX/cve-new/issues/18, VulDB entries at https://vuldb.com/?ctiid.347178, https://vuldb.com/?id.347178, and https://vuldb.com/?submit.754493, as well as the D-Link website at https://www.dlink.com/.

Details

CWE(s)

Affected Products

dlink
dwr-m960 firmware
1.01.07

CVEs Like This One

CVE-2026-2958Same product: Dlink Dwr-M960
CVE-2026-2853Same product: Dlink Dwr-M960
CVE-2026-2885Same product: Dlink Dwr-M960
CVE-2026-2928Same product: Dlink Dwr-M960
CVE-2026-2959Same product: Dlink Dwr-M960
CVE-2026-2881Same product: Dlink Dwr-M960
CVE-2026-2925Same product: Dlink Dwr-M960
CVE-2026-2854Same product: Dlink Dwr-M960
CVE-2026-2961Same product: Dlink Dwr-M960
CVE-2026-2926Same product: Dlink Dwr-M960

References