EUVD-2025-209309
GHSA-w6cx-r2cm-p462
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip_position_asp function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Analysis
Buffer overflow in D-Link DI-8300 router firmware v16.07.26A1 ip_position_asp function enables unauthenticated remote attackers to trigger denial of service through crafted input to the ip parameter. Network-accessible vulnerability requires no user interaction. No public exploit identified at time of analysis. CVSS 7.5 (High) reflects unauthenticated network attack vector with complete availability impact.
Technical Context
CWE-120 stack-based buffer overflow in ip_position_asp function lacks input validation on ip parameter length. Firmware v16.07.26A1 affected. Exploitable remotely without authentication (CVSS PR:N, AV:N). Overflow triggers crash/DoS but no memory corruption for code execution confirmed.
Affected Products
D-Link DI-8300 industrial router, firmware version 16.07.26A1. Vendor: D-Link Corporation. CPE data incomplete in source records.
Remediation
No vendor-released patch identified at time of analysis. D-Link has not published patched firmware version per security bulletin at https://www.dlink.com/en/security-bulletin/. Recommended immediate actions: restrict network access to DI-8300 management interface through firewall rules limiting source IP ranges to trusted administrative networks only; disable remote management features if not operationally required; implement network segmentation isolating affected devices. Monitor D-Link security bulletin and product page https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-8300 for future firmware updates. Consider replacement if device reaches end-of-life without patch availability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today