CVE-2026-2961
Published: 23 February 2026
Summary
CVE-2026-2961 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the stack-based buffer overflow by validating and sanitizing the manipulable submit-url argument in the VPN configuration endpoint.
Implements memory protection mechanisms like stack canaries and DEP to prevent exploitation of the stack-based buffer overflow vulnerability.
Requires timely remediation through firmware patching to eliminate the specific buffer overflow flaw in the D-Link DWR-M960 router's VPN endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing VPN web endpoint directly enables remote exploitation of a network device (T1190) and allows authenticated low-privileged access to escalate to full RCE (T1068).
NVD Description
A vulnerability has been found in D-Link DWR-M960 1.01.07. This affects the function sub_4196C4 of the file /boafrm/formVpnConfigSetup of the component VPN Configuration Endpoint. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack is possible to…
more
be carried out remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2026-2961 is a stack-based buffer overflow vulnerability affecting the D-Link DWR-M960 router in version 1.01.07. The issue resides in the function sub_4196C4 within the file /boafrm/formVpnConfigSetup of the VPN Configuration Endpoint, where manipulation of the submit-url argument triggers the overflow. Published on 2026-02-23, it is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The vulnerability enables remote exploitation by an attacker requiring low privileges (PR:L), with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Attackers can achieve high impacts on confidentiality, integrity, and availability without user interaction or high complexity, potentially leading to remote code execution via the buffer overflow.
Advisories and further details are documented in references such as the GitHub issue at https://github.com/LX-66-LX/cve-new/issues/28, VulDB entries at https://vuldb.com/?ctiid.347328, https://vuldb.com/?id.347328, and https://vuldb.com/?submit.754513, and the D-Link website at https://www.dlink.com/. No specific mitigation or patch details are outlined in the initial disclosure.
The exploit has been publicly disclosed and may be used, heightening the potential for real-world attacks on unpatched devices.
Details
- CWE(s)