EUVD-2025-209343
GHSA-82r6-wpf9-w38m
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /url_member.asp endpoint.
Analysis
Stack-based buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 allows unauthenticated remote attackers to trigger denial-of-service conditions by sending malformed name parameter values to the /url_member.asp endpoint. The vulnerability enables network-accessible attackers to crash the device without authentication or user interaction, disrupting availability of routing services. No public exploit identified at time of analysis.
Technical Context
CWE-121 stack-based buffer overflow caused by insufficient bounds checking on the name parameter in /url_member.asp. The firmware fails to validate input length before copying data to a fixed-size stack buffer, allowing oversized values to corrupt adjacent memory regions and destabilize the web management interface.
Affected Products
D-Link DI-8003 Industrial Gigabit VPN Router, firmware version 16.07.26A1. Vendor: D-Link Corporation. No granular CPE available.
Remediation
No vendor-released patch identified at time of analysis. Consult D-Link security bulletin at https://www.dlink.com/en/security-bulletin/ for official remediation guidance. Until patched firmware becomes available, restrict network access to the web management interface (/url_member.asp) through firewall rules permitting only trusted administrator IP addresses. Disable remote management features if not operationally required. Consider deploying network segmentation to isolate affected routers from untrusted networks. Monitor D-Link support channels for firmware updates addressing CVE-2025-50660. Contact D-Link technical support directly for enterprise deployment guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today