What is the CVSS score of CVE-2025-50665?

CVE-2025-50665 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of D-Link are affected by CVE-2025-50665?

CVE-2025-50665 affects D-Link DI-8003 routers (firmware 16.07.26A1) and enables unauthenticated attackers to remotely crash the device through malformed HTTP requests, rendering network…

How to fix or mitigate CVE-2025-50665?

Within 24 hours: Identify all D-Link DI-8003 devices in your network inventory and verify firmware version (check for 16.07.26A1). Restrict HTTP/HTTPS access to the /web_keyword.asp endpoint via firewall rules or network segmentation to untrusted networks. Within 7 days: Contact D-Link support for patch availability timeline and interim firmware recommendations; evaluate replacement models if patch is unavailable. Implement network-based rate limiting on HTTP GET requests to the affected endpoint. Within 30 days: Deploy replacement hardware or apply vendor patch immediately upon release; conduct network rescan to confirm all DI-8003 instances are remediated or isolated.

D-Link CVE-2025-50665

EUVD-2025-209353 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-08 mitre

GHSA-vgrj-r347-cwxq

D-Link Buffer Overflow

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 16:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2025-209353

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of input parameters in the /web_keyword.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request via the name, en, time, mem_gb2312, and mem_utf8 parameters.

AnalysisAI

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote denial-of-service attacks through crafted HTTP GET requests to /web_keyword.asp endpoint. Attackers exploit improper input validation in name, en, time, mem_gb2312, and mem_utf8 parameters to trigger memory corruption, causing device unavailability. CVSS 7.5 (High) severity reflects network-accessible attack vector requiring no user interaction or privileges. No public exploit identified at time of analysis; low observed exploitation activity.

Technical ContextAI

CWE-120 stack-based buffer overflow caused by insufficient bounds checking on user-supplied input to web management interface parameters. Vulnerability resides in legacy firmware web server parsing routines handling UTF-8 and GB2312 character encoding parameters, enabling memory overwrite conditions that crash device service availability without confidentiality or integrity impact per CVSS vector.

RemediationAI

No vendor-released patch identified at time of analysis. D-Link has not published specific firmware updates addressing CVE-2025-50665 in official security bulletins (https://www.dlink.com/en/security-bulletin/). Affected organizations should immediately isolate DI-8003 devices from untrusted networks, restrict web management interface access to trusted administrator IP ranges via firewall rules, and disable remote administration features if not operationally required. Monitor D-Link security bulletin page for future firmware releases. Consider replacement with actively supported hardware if device has reached end-of-life status. Consult vendor advisories and VulDB entry (https://vuldb.com/vuln/356313) for additional threat intelligence and potential vendor communications.