EUVD-2025-209310
GHSA-9hfh-f4vw-87qr
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the fx parameter in the jingx_asp function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Analysis
Buffer overflow in D-Link DI-8300 router firmware v16.07.26A1 enables unauthenticated remote attackers to trigger denial-of-service conditions through malformed fx parameter input to the jingx_asp function. Network-accessible exploitation requires no authentication or user interaction (CVSS AV:N/PR:N/UI:N). Impact limited to availability disruption; no data confidentiality or integrity compromise. No public exploit identified at time of analysis. EPSS 0.02% indicates low observed exploitation activity.
Technical Context
CWE-120 classic buffer overflow in jingx_asp function handler fails to validate fx parameter length boundaries before memory operations. Unchecked input copying enables stack/heap corruption triggering process crash. CVSS vector AC:L indicates trivial exploitation complexity against network-exposed embedded device management interface.
Affected Products
D-Link DI-8300 industrial router, firmware version 16.07.26A1. Vendor: D-Link Corporation. Single confirmed vulnerable version; broader version range impact unknown.
Remediation
No vendor-released patch identified at time of analysis. D-Link has not published firmware updates addressing CVE-2025-45058 per security bulletin https://www.dlink.com/en/security-bulletin/. Immediate mitigations: (1) disable remote management interface access, restricting administrative functions to trusted internal networks only; (2) implement strict firewall rules blocking external access to web management ports (typically TCP 80/443); (3) deploy network segmentation isolating affected devices from untrusted zones; (4) monitor D-Link security advisories for forthcoming patches. Organizations unable to implement network controls should consider hardware replacement with actively supported alternatives. Verify product support status at https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-8300 as legacy devices may receive limited security maintenance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today