CVE-2026-2885
Published: 21 February 2026
Summary
CVE-2026-2885 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2885 is a stack-based buffer overflow vulnerability in the D-Link DWR-M960 router running firmware version 1.01.07. The flaw resides in the function sub_469104 within the file /boafrm/formIpv6Setup, where manipulation of the submit-url argument triggers the overflow. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation.
Attackers with low privileges, such as authenticated users, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution, data theft, or device compromise on the affected router.
Advisories and details are documented in references including a GitHub issue at https://github.com/LX-66-LX/cve-new/issues/19 and VulDB entries at https://vuldb.com/?ctiid.347179, https://vuldb.com/?id.347179, and https://vuldb.com/?submit.754496, with the vendor site at https://www.dlink.com/. No specific patch or mitigation details are outlined in the available information.
A public exploit has been released, increasing the risk of real-world attacks against unpatched D-Link DWR-M960 devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7524
Vulnerability details
A security flaw has been discovered in D-Link DWR-M960 1.01.07. The impacted element is the function sub_469104 of the file /boafrm/formIpv6Setup. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may be performed from remote. The…
more
exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack buffer overflow in public web form (formIpv6Setup) on network device enables remote authenticated RCE; directly maps to exploiting public-facing apps for initial access and priv escalation to arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the known stack-based buffer overflow in the D-Link router's formIpv6Setup function by requiring patching or firmware updates to eliminate the vulnerability.
Information input validation enforces bounds checking on the submit-url argument to prevent the stack-based buffer overflow exploitation.
Memory protection mechanisms like stack canaries and non-executable stacks mitigate successful exploitation of the stack-based buffer overflow even if input validation fails.