A buffer overflow flaw exists in the QoS configuration page (qos.asp) of D‑Link DI‑8003 routers running firmware 16.07.26A1, where the "wans" parameter is processed without proper bounds checking. The overflow can corrupt memory and may result in a denial of service or, in the worst case, allow an attacker to execute arbitrary code on the device. The weakness is classified as a classic buffer overrun (CWE‑120).

The issue specifically targets the D‑Link DI‑8003 model with firmware version 16.07.26A1. No other firmware releases are mentioned in the CVE data, so the impact on earlier or later releases is unknown.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector, based on the description, involves accessing the router’s web management interface at the qos.asp endpoint, which may require administrative credentials or the exploitation of weak or default passwords. The overall risk is moderate to high for routers that expose their management interface to untrusted networks.