CVE-2026-2959
Published: 23 February 2026
Summary
CVE-2026-2959 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the stack-based buffer overflow flaw in the D-Link DWR-M960 firmware to prevent remote exploitation.
Implements memory protection mechanisms such as stack canaries or DEP to directly mitigate stack-based buffer overflow vulnerabilities like this one.
Enforces validation of the 'url' argument input to the formNewSchedule function to restrict operations within memory bounds and reduce overflow risk.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow enables remote exploitation of public-facing router web interface (formNewSchedule) for arbitrary code execution; low-privilege requirement to full device control maps to privilege escalation.
NVD Description
A vulnerability was detected in D-Link DWR-M960 1.01.07. Affected by this vulnerability is the function sub_44E0F8 of the file /boafrm/formNewSchedule. Performing a manipulation of the argument url results in stack-based buffer overflow. Remote exploitation of the attack is possible. The…
more
exploit is now public and may be used.
Deeper analysisAI
CVE-2026-2959 is a stack-based buffer overflow vulnerability in the D-Link DWR-M960 router running firmware version 1.01.07. The flaw affects the function sub_44E0F8 in the file /boafrm/formNewSchedule, where manipulation of the "url" argument triggers the overflow. Published on 2026-02-23, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
Remote exploitation is possible by attackers who have low privileges, requiring network access and low attack complexity but no user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially enabling arbitrary code execution on the affected device.
Advisories provide further details via references such as https://github.com/LX-66-LX/cve-new/issues/26, https://vuldb.com/?ctiid.347326, https://vuldb.com/?id.347326, https://vuldb.com/?submit.754511, and https://www.dlink.com/.
The exploit is public and may be used, elevating the risk of real-world attacks on unpatched D-Link DWR-M960 devices.
Details
- CWE(s)