CVE-2026-2926
Published: 22 February 2026
Summary
CVE-2026-2926 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of inputs like the submit-url argument to prevent stack-based buffer overflows in the LTE Configuration Endpoint.
Implements memory protections such as stack canaries and non-executable stacks to mitigate stack-based buffer overflow exploits leading to arbitrary code execution.
Directly addresses remediation of the specific buffer overflow flaw in D-Link DWR-M960 firmware version 1.01.07 through patching and updates.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public web form (/boafrm/formLteSetup) allows remote authenticated attackers to achieve arbitrary code execution; directly maps to exploitation of a public-facing application (T1190) and exploitation for privilege escalation from low-priv web session to full device control (T1068).
NVD Description
A flaw has been found in D-Link DWR-M960 1.01.07. This affects the function sub_4237AC of the file /boafrm/formLteSetup of the component LTE Configuration Endpoint. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can…
more
be launched remotely. The exploit has been published and may be used.
Deeper analysisAI
CVE-2026-2926 is a stack-based buffer overflow vulnerability affecting the D-Link DWR-M960 router on firmware version 1.01.07. The issue resides in the sub_4237AC function of the /boafrm/formLteSetup file within the LTE Configuration Endpoint component. It is triggered by manipulating the submit-url argument, as identified by CWEs-119 and CWE-121. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-22.
Attackers can exploit this flaw remotely over the network with low complexity and no user interaction required. Exploitation demands low privileges (PR:L), such as those of an authenticated user, and results in high impacts across confidentiality, integrity, and availability. Given the nature of the stack-based buffer overflow, successful attacks could enable arbitrary code execution on the affected device.
Advisories and additional details are documented in references including a GitHub issue at https://github.com/LX-66-LX/cve-new/issues/21 and VulDB entries at https://vuldb.com/?ctiid.347273, https://vuldb.com/?id.347273, and https://vuldb.com/?submit.754498, with the vendor page at https://www.dlink.com/.
An exploit for this vulnerability has been publicly disclosed and may be actively used by attackers.
Details
- CWE(s)