What is the CVSS score of CVE-2025-50663?

CVE-2025-50663 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of D-Link are affected by CVE-2025-50663?

D-Link DI-8003 routers running firmware 16.07.26A1 are vulnerable to unauthenticated remote denial-of-service attacks through a buffer overflow in the administrative interface, potentially disrupting…

How to fix or mitigate CVE-2025-50663?

Within 24 hours: Inventory all D-Link DI-8003 routers and identify those running firmware version 16.07.26A1. Within 7 days: Check D-Link support portal for available firmware updates beyond 16.07.26A1; if updates exist, plan and schedule firmware upgrades during maintenance windows. Within 30 days: Complete firmware upgrade on all affected devices to the latest available version, and implement network access controls restricting /usb_paswd.asp endpoint to trusted administrative networks only.

D-Link CVE-2025-50663

EUVD-2025-209349 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-08 mitre

GHSA-v9v4-x4hg-jg4g

D-Link Buffer Overflow Stack Overflow

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 16:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2025-209349

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /usb_paswd.asp endpoint.

AnalysisAI

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote denial-of-service attacks via crafted name parameter to /usb_paswd.asp endpoint. Stack-based buffer overflow (CWE-121) triggers memory corruption leading to service disruption. Affects network-accessible administrative interfaces without authentication barrier (CVSS AV:N/PR:N). No public exploit identified at time of analysis. Low observed exploitation activity (EPSS <1%).

Technical ContextAI

Root cause is stack-based buffer overflow (CWE-121) in usb_paswd.asp endpoint name parameter handler. Insufficient input validation allows unbounded data copying to fixed-size stack buffer. Memory corruption prevents controlled code execution but triggers denial-of-service through application crash or resource exhaustion. Network-reachable attack surface requires no privileges.

RemediationAI

No vendor-released patch identified at time of analysis. Immediately restrict network access to administrative interfaces (/usb_paswd.asp and related endpoints) using firewall rules or ACLs limiting access to trusted management networks only. Disable remote administration features if not operationally required. Monitor D-Link security bulletin portal for firmware updates: https://www.dlink.com/en/security-bulletin/. Consider device replacement if vendor discontinues support for DI-8003 platform. Implement network segmentation to isolate vulnerable devices from untrusted networks. Review VulDB advisory for technical details: https://vuldb.com/vuln/356357.