This vulnerability is a buffer overflow caused by the ip parameter in the ip_position_asp function of the D-Link DI-8300 firmware. An attacker can supply a crafted input that overflows the buffer and causes the device to crash, resulting in a loss of availability. The weakness is a classic buffer copy without bounds checking (CWE-120).

Only the D-Link DI-8300 model running firmware version 16.07.26A1 is affected. The issue is identified by the CPE entries for the device and its firmware. No other D-Link products or firmware versions are indicated.

The CVSS score of 7.5 indicates a high risk to availability. The EPSS score is less than 1 percent, suggesting low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread active exploitation. Access appears to be remote through the device’s web interface, so an attacker only needs network connectivity to the target device. Because the flaw is a buffer overflow, a remote attacker could trigger the crash without authentication if the function is exposed publicly.