D-Link DWR-M960 Stack-Based Buffer Overflow Vulnerability in DDNS Settings Handler

A stack-based buffer overflow vulnerability has been identified in the D-Link DWR-M960 router, specifically in the DDNS settings handler within the file '/boafrm/formDdns'. The issue arises in the function 'sub_4648F0', where the 'submit-url' parameter is processed without proper bounds checking. This vulnerability allows for remote exploitation, leading to potential application crashes and arbitrary code execution.

Impact

Exploitation of this vulnerability can cause the web server to crash or the device to reboot unexpectedly. Additionally, it could allow an attacker to execute arbitrary code with root privileges by overwriting function pointers or control structures in memory.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/boafrm/formDdns' with an oversized 'submit-url' parameter. Disabling the 'ddnsEnabled' option can help reach the vulnerable endpoint without needing valid DDNS credentials.