A buffer overflow condition is present in the D‑Link DI‑8003 router when the "s" parameter of the pppoe_list_opt.asp endpoint is supplied with an excessively large value. The firmware fails to limit the size of this input, allowing a crafted HTTP request to overwrite memory and potentially crash the device or inject malicious code. This class of weakness is identified as CWE‑120, which indicates unsafe handling of buffer data.

The vulnerability affects the D‑Link DI‑8003 router running firmware version 16.07.26a1. No other firmware releases are listed as vulnerable, so devices with later firmware may not be impacted.

The CVSS score of 7.5 signals a high severity risk. The EPSS score of less than 1 percent suggests that exploitation is not widely observed, and the vulnerability is not in the CISA KEV catalog. Attackers can trigger the overflow by sending a malformed request to the router’s exposed HTTP interface, which is reachable from external networks unless the device is isolated or access is restricted.