PT-2026-21454 · D Link · D-Link Dwr-M960

Lx-66-Lx · Published 2026-02-22 · Updated 2026-02-28 · CVE-2026-2962

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DWR-M960 version 1.01.07

Description A flaw exists in the D-Link DWR-M960 that allows for a stack-based buffer overflow. This issue is located within the sub 460F30 function of the /boafrm/formDateReboot file, part of the Scheduled Reboot Configuration Endpoint. The submit-url argument can be manipulated to trigger the overflow, and the attack can be carried out remotely. The exploit for this issue has been publicly released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2026-2962

Affected Products

D-Link Dwr-M960

References · 18

• 🔥 https://github.com/LX-66-LX/cve-new/issues/29 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2962 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2962 · Vendor Advisory
• https://t.me/CVEtracker/45463 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2025749257345532400 · Twitter Post
• https://t.me/cveNotify/152799 · Telegram Post
• https://twitter.com/cracbot/status/2027338055708016836 · Twitter Post
• https://twitter.com/CveFindCom/status/2025747648079114725 · Twitter Post
• https://dlink.com · Note
• https://twitter.com/CVEnew/status/2025809034532761814 · Twitter Post
• https://vuldb.com/?id.347329 · Note
• https://twitter.com/CVEarity/status/2025945291183317379 · Twitter Post
• https://vuldb.com/?ctiid.347329 · Note
• https://twitter.com/TheHackerWire/status/2025741972800151740 · Twitter Post
• https://twitter.com/CveTodo/status/2025744980384313522 · Twitter Post