Description

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-08T18:16:56.783Z",
  "pubdate": "2026-08-08T18:16:56.783Z",
  "executiveSummary": "A critical buffer overflow vulnerability exists within the quicksetup.cgi interface of D-Link DWR-M961 devices running hardware version C1 and software version 1.1.2_C1_202602110044. This flaw allows a remote attacker to supply overly long strings to specific input parameters, leading to memory corruption.\nThe vulnerability enables remote attackers to execute arbitrary commands on the underlying operating system or trigger a denial of service through application crashes. The impact compromises the confidentiality, integrity, and availability of the affected device.\nExploitation requires network connectivity to the target interface and the delivery of a specifically crafted payload containing malicious input designed to overwrite critical stack memory structures. No specific authentication mechanisms are detailed as mitigating the initial vector, lowering the barrier for remote exploitation against exposed management surfaces.",
  "technicalDetails": "The vulnerability resides in the quicksetup.cgi binary component handling HTTP requests for the device setup routine on D-Link DWR-M961 hardware version C1, specifically software version 1.1.2_C1_202602110044.\nThe root cause stems from unsafe handling of user-supplied input where data passed via the test4, ssid2, and username parameters is copied into fixed-size stack buffers without adequate bounds checking or length validation.\nWhen a remote attacker submits a maliciously crafted HTTP request containing excessively long strings to the vulnerable parameters within the quicksetup.cgi interface, a stack-based buffer overflow occurs.\nThe attack flow proceeds as follows: 1) The attacker crafts an HTTP request targeting the quicksetup.cgi endpoint. 2) The payload injects oversized data into the test4, ssid2, or username fields. 3) The application processes the input and writes the excessive data past the boundaries of the allocated stack buffer. 4) The overflow overwrites adjacent stack variables, including the saved frame pointer and return address.\nBy carefully constructing the payload, an attacker can hijack the execution flow of the binary, allowing for the execution of arbitrary system commands or arbitrary code execution under the privileges of the web application context.\nAlternatively, supplying corrupted memory structures without precise shellcode causes the process to crash, resulting in a denial of service condition for the device administration functionality.\nThe affected component is exposed over the network, allowing remote attackers to trigger the vulnerability without prior authentication, depending on the network exposure and interface configuration of the targeted device."
}