Description

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T18:16:56.647Z",
  "pubdate": "2026-08-08T18:16:56.647Z",
  "executiveSummary": "D-Link DWR-M961 devices running hardware version C1 and software version 1.1.2_C1_202602110044 contain a critical stack-based buffer overflow vulnerability residing within the app.cgi interface. This vulnerability arises from inadequate boundary checking when processing user-supplied input submitted to the netAcc.addlist[].name field.\nA remote, unauthenticated attacker can exploit this flaw by transmitting a specially crafted HTTP request containing an excessively long string to the vulnerable parameter. Successful exploitation allows the adversary to overwrite adjacent stack memory, leading to arbitrary command execution on the underlying operating system or triggering a denial of service condition via device crashing.\nThe presence of this vulnerability in a core network management interface poses severe risk implications, as compromised devices can be fully controlled by remote entities, potentially serving as an entry point for lateral movement within internal networks or functioning as nodes in broader cyberattack campaigns.\nMitigation requires applying vendor-supplied software updates or patches once available, restricting management interface access to trusted internal networks, and disabling remote administration capabilities where feasible.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow affecting the app.cgi component on D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044.\nThe root cause of the vulnerability stems from unsafe memory handling routines, such as standard string copy or concatenation functions that fail to properly bound-check the length of input data copied into fixed-size stack buffers.\nSpecifically, the vulnerable endpoint app.cgi processes configuration parameters associated with network account settings. When parsing the netAcc.addlist[].name field, the application accepts user-supplied data without validating its length against the destination buffer allocation size.\nThe attack vector is network-based, allowing a remote attacker to interact directly with the web management interface exposed by the device. Depending on how the interface is configured and exposed, this may be accessible over the local area network or potentially the wider internet if WAN management is enabled.\nTo execute an attack, the adversary crafts a malicious HTTP request targeting the app.cgi interface. The payload incorporates an overly long string injected into the netAcc.addlist[].name parameter. When the binary processes this input, the excess data overflows the boundaries of the target stack buffer.\nBy carefully structuring the payload, the attacker can overwrite critical saved execution contexts, such as the stack frame pointer and return address, or adjacent local variables. If designed for arbitrary code execution, the payload can inject shellcode or redirect execution flow to existing executable segments or Return-Oriented Programming chains.\nAlternatively, if the payload simply corrupts critical memory structures without providing valid execution redirection, the process crashes, resulting in a denial of service condition that reboots or hangs the device.\nThe vulnerability requires no prior authentication or elevated privileges, lowering the barrier to entry for potential threat actors capable of reaching the vulnerable network interface."
}