CVE-2026-2962
Published: 23 February 2026
Summary
CVE-2026-2962 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Dwr-M960 Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-2962 is a stack-based buffer overflow vulnerability affecting the D-Link DWR-M960 router on firmware version 1.01.07. The flaw resides in the sub_460F30 function of the /boafrm/formDateReboot endpoint within the Scheduled Reboot Configuration component. It is triggered by manipulation of the submit-url argument and is classified under CWE-119 and CWE-121.
The vulnerability enables remote exploitation by an attacker with low privileges (PR:L), requiring low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a CVSS v3.1 base score of 8.8. An exploit for this issue has been made public.
Advisories and details are documented in references including a GitHub issue at https://github.com/LX-66-LX/cve-new/issues/29 disclosing the exploit, VulDB entries at https://vuldb.com/?ctiid.347329, https://vuldb.com/?id.347329, and https://vuldb.com/?submit.754517, as well as the D-Link website at https://www.dlink.com/. These sources provide further vulnerability information, though specific patch or mitigation guidance is not detailed in the primary description.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7557
Vulnerability details
A vulnerability was found in D-Link DWR-M960 1.01.07. This vulnerability affects the function sub_460F30 of the file /boafrm/formDateReboot of the component Scheduled Reboot Configuration Endpoint. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack may be…
more
performed from remote. The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in internet-facing router web endpoint (/boafrm/formDateReboot) with PR:L allows remote code execution; directly maps to T1190 for exploiting public-facing applications and T1068 for privilege escalation from low-priv web access to full device control (C/I/A:H).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of inputs like the submit-url argument at the /boafrm/formDateReboot endpoint to directly prevent stack-based buffer overflows.
Implements memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of stack-based buffer overflows even if input validation fails.
Mandates timely remediation of identified flaws, including patching the buffer overflow in D-Link DWR-M960 firmware version 1.01.07.