What is the CVSS score of CVE-2025-50655?

CVE-2025-50655 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of D-Link are affected by CVE-2025-50655?

CVE-2025-50655 affects D-Link DI-8003 routers running firmware 16.07.26A1, allowing unauthenticated attackers to remotely crash the device through a network-accessible buffer overflow vulnerability.

How to fix or mitigate CVE-2025-50655?

Within 24 hours: Identify and isolate all D-Link DI-8003 devices running firmware 16.07.26A1 in your network environment; document inventory with asset location and business criticality. Within 7 days: Contact D-Link support for firmware update availability and estimated release timeline; implement network-level access restrictions to the /thd_group.asp endpoint via firewall rules to limit exposure. Within 30 days: Deploy firmware updates immediately upon release from D-Link; if no patch is available within 30 days, evaluate router replacement or permanent network segmentation as mitigation.

D-Link CVE-2025-50655

EUVD-2025-209337 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-08 mitre

D-Link Buffer Overflow Stack Overflow

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 16:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2025-209337

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /thd_group.asp endpoint.

AnalysisAI

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote denial-of-service attacks through malformed name parameter in /thd_group.asp endpoint. Improper input validation triggers stack-based buffer overflow, causing device crashes or service disruption without requiring user interaction. Attack vector is network-accessible with low complexity. No public exploit identified at time of analysis.

Technical ContextAI

Stack-based buffer overflow (CWE-121) occurs when processing unchecked name parameter length in web interface endpoint /thd_group.asp. Vulnerable firmware version 16.07.26A1 lacks boundary validation, allowing oversized inputs to corrupt stack memory. Network-accessible attack surface (AV:N) with no authentication requirement (PR:N) enables trivial exploitation targeting availability.

RemediationAI

No vendor-released patch identified at time of analysis. Consult D-Link security bulletin at https://www.dlink.com/en/security-bulletin/ for updated firmware releases addressing CVE-2025-50655. Until patched firmware becomes available, implement network segmentation to restrict administrative interface access to trusted management networks only. Deploy web application firewall rules filtering excessive parameter lengths on /thd_group.asp endpoint. Consider replacing affected devices if vendor discontinues support for DI-8003 model line. Monitor vendor advisory portal for patch availability announcements.