CVE-2025-50661
Buffer Overflow in D-Link DI-8003 /url_rule.asp Endpoint
Publication date: 2026-04-08
Last updated on: 2026-04-22
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | di-8003_firmware | 16.07.26a1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a buffer overflow in the D-Link DI-8003 device, version 16.07.26A1. It occurs because the device improperly handles multiple parameters in the /url_rule.asp endpoint. An attacker can exploit this by sending a specially crafted HTTP GET request with specific parameters such as name, en, ips, u, time, act, rpri, and log.
How can this vulnerability impact me? :
Exploitation of this buffer overflow vulnerability could allow an attacker to cause unexpected behavior in the device, such as crashing it or potentially executing arbitrary code. This could lead to denial of service or unauthorized control over the device.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /url_rule.asp endpoint to trusted users only, such as by implementing IP filtering or firewall rules.
Additionally, monitor and block suspicious HTTP GET requests containing the vulnerable parameters.
If possible, update the device firmware to a version that addresses this vulnerability once available.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP GET requests to the /url_rule.asp endpoint on D-Link DI-8003 devices. Specifically, look for requests containing the parameters name, en, ips, u, time, act, rpri, and log with unusual or crafted values that could trigger a buffer overflow.
A possible detection method is to use network traffic analysis tools or web server logs to filter for such requests.
- Use tcpdump or Wireshark to capture HTTP GET requests to /url_rule.asp, for example: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/url_rule.asp'
- Use grep on web server logs to find suspicious requests: grep '/url_rule.asp' access.log | grep -E 'name=|en=|ips=|u=|time=|act=|rpri=|log='