Vulnerabilities ›

CVE-2026-2958

High ⚡ Exploit Available

CWE-119 — Weakness Type

                    Published: Feb 23, 2026                      ·  Modified: Feb 28, 2026                      ·  Source: NVD                

CVSS v3

8.8

🔗 NVD Official

📄 Description (English)

A security vulnerability has been detected in D-Link DWR-M960 1.01.07. Affected is the function sub_457C5C of the file /boafrm/formWsc. Such manipulation of the argument save_apply leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

🤖 AI Executive Summary

A critical stack-based buffer overflow vulnerability exists in D-Link DWR-M960 router firmware version 1.01.07, affecting the /boafrm/formWsc endpoint. The vulnerability allows remote attackers to execute arbitrary code with high privileges by manipulating the save_apply parameter. With public exploit availability and widespread router deployment in Saudi networks, immediate patching is essential to prevent unauthorized access and data exfiltration.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: Apr 23, 2026 01:06

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability poses severe risk to Saudi telecommunications infrastructure (STC, Mobily, Zain), government networks (NCA, CITC), and enterprise networks utilizing D-Link DWR-M960 routers as edge devices. Banking sector (SAMA-regulated institutions) faces elevated risk if routers are deployed in branch networks or as VPN gateways. Energy sector (ARAMCO, SEC) and healthcare organizations using these devices for network segmentation are particularly vulnerable. The publicly disclosed exploit and remote attack vector enable mass exploitation across Saudi IP space.

🏢 Affected Saudi Sectors

Telecommunications (STC, Mobily, Zain) Government (NCA, CITC, Ministry networks) Banking (SAMA-regulated institutions) Energy (ARAMCO, SEC) Healthcare (MOH, private hospitals) Enterprise Networks ISPs and Network Service Providers

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1068 - Exploitation for Privilege Escalation T1543 - Create or Modify System Process T1059 - Command and Scripting Interpreter T1021 - Remote Service Session Initiation T1133 - External Remote Services

⚖️ Saudi Risk Score (AI)

9.1

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Identify all D-Link DWR-M960 devices running firmware 1.01.07 in your network using asset discovery tools

2. Isolate affected routers from critical network segments if patching cannot be completed within 24 hours

3. Disable remote management features (web interface access from WAN) immediately

4. Implement network-level access controls restricting access to /boafrm/formWsc endpoint

PATCHING GUIDANCE:

1. Download latest firmware from D-Link support portal (verify version > 1.01.07)

2. Schedule maintenance window for firmware upgrade during low-traffic periods

3. Backup router configuration before upgrade

4. Perform factory reset if upgrade fails, then reconfigure from backup

5. Verify firmware version post-upgrade using CLI: show version

COMPENSATING CONTROLS (if patch unavailable):

1. Deploy WAF rules blocking POST requests to /boafrm/formWsc with suspicious save_apply parameters

2. Implement rate limiting on web interface (max 5 requests/minute per source IP)

3. Enable router access logs and monitor for exploitation attempts

4. Restrict router management access to specific trusted IP ranges via ACLs

5. Deploy IDS/IPS signatures detecting buffer overflow payloads in HTTP requests

DETECTION RULES:

1. Monitor for HTTP POST requests to /boafrm/formWsc with save_apply parameter > 256 bytes

2. Alert on multiple failed authentication attempts to router web interface

3. Track firmware version changes in CMDB; flag unexpected downgrades

4. Monitor for shell metacharacters (|, ;, &, `, $) in save_apply parameter values

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. تحديد جميع أجهزة D-Link DWR-M960 التي تعمل بالإصدار 1.01.07 في شبكتك باستخدام أدوات اكتشاف الأصول

2. عزل الأجهزة المتأثرة عن قطاعات الشبكة الحرجة إذا لم يتمكن التصحيح خلال 24 ساعة

3. تعطيل ميزات الإدارة البعيدة (الوصول إلى واجهة الويب من WAN) فوراً

4. تطبيق عناصر تحكم الوصول على مستوى الشبكة لتقييد الوصول إلى نقطة النهاية /boafrm/formWsc

إرشادات التصحيح:

1. تحميل أحدث إصدار من البرنامج الثابت من بوابة دعم D-Link (التحقق من الإصدار > 1.01.07)

2. جدولة نافذة صيانة لترقية البرنامج الثابت خلال فترات حركة المرور المنخفضة

3. نسخ احتياطي لإعدادات الجهاز قبل الترقية

4. إجراء إعادة تعيين المصنع إذا فشلت الترقية، ثم إعادة التكوين من النسخة الاحتياطية

5. التحقق من إصدار البرنامج الثابت بعد الترقية باستخدام CLI

عناصر التحكم البديلة:

1. نشر قواعد WAF لحجب طلبات POST إلى /boafrm/formWsc بمعاملات save_apply مريبة

2. تطبيق تحديد معدل على واجهة الويب (5 طلبات كحد أقصى/دقيقة لكل عنوان IP مصدر)

3. تفعيل سجلات الوصول للجهاز ومراقبة محاولات الاستغلال

4. تقييد الوصول إلى إدارة الجهاز بنطاقات IP موثوقة محددة عبر ACLs

5. نشر توقيعات IDS/IPS للكشف عن حمولات تجاوز المخزن المؤقت في طلبات HTTP

قواعد الكشف:

1. مراقبة طلبات HTTP POST إلى /boafrm/formWsc بمعامل save_apply > 256 بايت

2. تنبيه محاولات المصادقة الفاشلة المتعددة لواجهة ويب الجهاز

3. تتبع تغييرات إصدار البرنامج الثابت في CMDB؛ علم الترقيات غير المتوقعة

4. مراقبة أحرف shell الخاصة (|, ;, &, `, $) في قيم معامل save_apply

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.12.6.1 - Management of technical vulnerabilities ECC 2024 A.14.2.1 - Secure development policy ECC 2024 A.12.2.1 - Monitoring and logging of network activities ECC 2024 A.13.1.3 - Segregation of networks

🔵 SAMA CSF

SAMA CSF ID.RA-1 - Asset management and vulnerability identification SAMA CSF PR.IP-12 - Security patches and updates management SAMA CSF DE.CM-1 - Detection and monitoring of anomalous activities SAMA CSF RS.MI-2 - Incident response and containment

🟡 ISO 27001:2022

ISO 27001:2022 A.12.3.1 - Configuration management ISO 27001:2022 A.14.2.1 - Secure development and change management ISO 27001:2022 A.8.1.1 - Inventory of assets ISO 27001:2022 A.12.6.1 - Management of technical vulnerabilities

🟣 PCI DSS v4.0.1

PCI DSS 6.2 - Security patches for system components PCI DSS 11.2 - Vulnerability scanning and assessment PCI DSS 1.1 - Firewall configuration standards

🔗 References & Sources 5

🔗

https://github.com/LX-66-LX/cve-new/issues/25

cna@vuldb.com

Exploit Issue Tracking Third Party Advisory

🔗

https://vuldb.com/?ctiid.347325

cna@vuldb.com

Permissions Required VDB Entry

🔗

https://vuldb.com/?id.347325

cna@vuldb.com

Third Party Advisory VDB Entry

🔗

https://vuldb.com/?submit.754509

cna@vuldb.com

Third Party Advisory VDB Entry

🔗

https://www.dlink.com/

cna@vuldb.com

Product

📦 Affected Products / CPE 1 entries

dlink:dwr-m960_firmware:1.01.07

📊 CVSS Score

8.8

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score8.8

CWECWE-119

EPSS0.03%

Exploit ✓ Yes

Patch ✓ Yes

Published 2026-02-23

Source Feed nvd

🇸🇦 Saudi Risk Score

9.1

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

exploit-available CWE-119

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-2958

💬 Comments

Introduce Yourself

Sign In Required