CVE-2025-50666
Buffer Overflow in D-Link DI-8003 /web_post.asp Endpoint
Publication date: 2026-04-08
Last updated on: 2026-04-22
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | di-8003_firmware | 16.07.26a1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a buffer overflow in the D-Link DI-8003 device, version 16.07.26A1. It occurs because the device improperly handles multiple parameters in the /web_post.asp endpoint. An attacker can exploit this by sending a specially crafted HTTP GET request with manipulated parameters such as name, en, user_id, log, and time.
How can this vulnerability impact me? :
Exploitation of this buffer overflow vulnerability could allow an attacker to cause unexpected behavior in the device, such as crashes or potentially executing arbitrary code. This could lead to denial of service or unauthorized control over the affected device.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP GET requests to the /web_post.asp endpoint on D-Link DI-8003 devices, specifically looking for crafted requests with suspicious parameters such as name, en, user_id, log, and time.
Since no specific detection commands or tools are provided, a general approach would be to use network monitoring or web server logs to identify unusual or malformed GET requests targeting /web_post.asp with these parameters.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /web_post.asp endpoint, applying input validation or filtering on parameters such as name, en, user_id, log, and time, and monitoring for suspicious HTTP GET requests.
Since no patches or specific mitigation instructions are provided, consider isolating affected devices from untrusted networks and limiting exposure until a fix is available.