CVE-2026-2925 D-Link DWR-M960 Bridge VLAN Configuration Endpoint formBridgeVlan sub_42B5A0 stack-based overflow

What is CVE-2026-2925?

CVE-2026-2925 is a high-severity memory corruption vulnerability in D-Link DWR-M960, published on 22 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was detected in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_42B5A0 of the file /boafrm/formBridgeVlan of the component Bridge VLAN Configuration Endpoint. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

Weakness: CWE-121, CWE-119

Which versions are affected by CVE-2026-2925?

It affects 1 product.

Products include Dlink Dwr-M960 Firmware.

How do I fix CVE-2026-2925?

No fix has been published for CVE-2026-2925 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-2925 being exploited?

There is no known exploitation of CVE-2026-2925 in the wild and no public exploit code.

Other vulnerabilities in D-Link DWR-M960

• CVE-2026-2960 D-Link DWR-M960 formDhcpv6s sub_468D64 stack-based overflow High 8.7
• CVE-2026-2961 D-Link DWR-M960 VPN Configuration Endpoint formVpnConfigSetup sub_4196C4 stack-based overflow High 8.7
• CVE-2026-2962 D-Link DWR-M960 Scheduled Reboot Configuration Endpoint formDateReboot sub_460F30 stack-based overflow High 8.7
• CVE-2026-2926 D-Link DWR-M960 LTE Configuration Endpoint formLteSetup sub_4237AC stack-based overflow High 8.7
• CVE-2026-2927 D-Link DWR-M960 Operation Mode Configuration Endpoint formOpMode sub_462590 stack-based overflow High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v4fw-f854-rf72.