EUVD-2025-209358

| CVE-2025-50668 HIGH
2026-04-08 mitre GHSA-9rcc-8r82-33hr
7.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Apr 08, 2026 - 19:31 vuln.today
EUVD ID Assigned
Apr 08, 2026 - 19:31 euvd
EUVD-2025-209358
CVE Published
Apr 08, 2026 - 00:00 nvd
HIGH 7.5

Tags

D-Link Buffer Overflow

Description

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the s parameter in the /web_list_opt.asp endpoint.

Analysis

Buffer overflow in D-Link DI-8003 router firmware 16.07.26A1 enables unauthenticated remote attackers to trigger denial-of-service conditions through malformed 's' parameter input to the /web_list_opt.asp endpoint. The vulnerability requires no user interaction and is exploitable over the network with low attack complexity. CVSS 7.5 (High) reflects network-accessible DoS impact. No public exploit identified at time of analysis; low observed exploitation activity (EPSS <1%).

Technical Context

CWE-120 stack-based buffer overflow in web management interface parameter parsing. Insufficient bounds checking on user-supplied 's' parameter allows memory corruption leading to service crash. CVSS vector PR:N confirms unauthenticated attack surface. Network-accessible administrative endpoint lacks input validation, typical of embedded device firmware vulnerabilities targeting legacy routing hardware.

Affected Products

D-Link DI-8003 router, firmware version 16.07.26A1. Vendor: D-Link Corporation. Specific CPE data not provided in authoritative sources.

Remediation

No vendor-released patch identified at time of analysis. Consult D-Link Security Bulletin at https://www.dlink.com/en/security-bulletin/ for updates specific to DI-8003 model. Immediate mitigations: disable remote administrative access to /web_list_opt.asp endpoint; restrict management interface access to trusted internal networks only via firewall rules; deploy network segmentation isolating device from untrusted networks. Monitor vendor communications for firmware release addressing CVE-2025-50668. If device reaches end-of-life without patch, consider hardware replacement with actively supported models.

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +38
POC: 0

Share

EUVD-2025-209358 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy