What is the CVSS score of CVE-2025-50668?

CVE-2025-50668 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of D-Link are affected by CVE-2025-50668?

CVE-2025-50668 is a high-severity denial-of-service vulnerability in D-Link DI-8003 routers (firmware 16.07.26A1) that allows unauthenticated remote attackers to crash affected devices through…

How to fix or mitigate CVE-2025-50668?

Within 24 hours: Identify all D-Link DI-8003 devices in your network and verify firmware version (16.07.26A1 is affected); document device inventory and network segments they protect. Within 7 days: Contact D-Link support for firmware updates or workarounds; if updates are unavailable, implement network segmentation to restrict access to the /web_list_opt.asp endpoint and disable remote management features if not operationally required. Within 30 days: Deploy updated firmware as released by D-Link; if no patch materializes, evaluate replacement with alternative routing equipment and complete migration plan.

D-Link CVE-2025-50668

EUVD-2025-209358 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-08 mitre

GHSA-9rcc-8r82-33hr

D-Link Buffer Overflow

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2025-209358

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

CVE Published

Apr 08, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the s parameter in the /web_list_opt.asp endpoint.

AnalysisAI

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote attackers to trigger denial-of-service conditions through malformed 's' parameter input to the /web_list_opt.asp endpoint. The vulnerability requires no user interaction and is exploitable over the network with low attack complexity. CVSS 7.5 (High) reflects network-accessible DoS impact. No public exploit identified at time of analysis; low observed exploitation activity (EPSS <1%).

Technical ContextAI

CWE-120 stack-based buffer overflow in web management interface parameter parsing. Insufficient bounds checking on user-supplied 's' parameter allows memory corruption leading to service crash. CVSS vector PR:N confirms unauthenticated attack surface. Network-accessible administrative endpoint lacks input validation, typical of embedded device firmware vulnerabilities targeting legacy routing hardware.

RemediationAI

No vendor-released patch identified at time of analysis. Consult D-Link Security Bulletin at https://www.dlink.com/en/security-bulletin/ for updates specific to DI-8003 model. Immediate mitigations: disable remote administrative access to /web_list_opt.asp endpoint; restrict management interface access to trusted internal networks only via firewall rules; deploy network segmentation isolating device from untrusted networks. Monitor vendor communications for firmware release addressing CVE-2025-50668. If device reaches end-of-life without patch, consider hardware replacement with actively supported models.