A buffer overflow flaw arises from insufficient input validation of the vlan_name field in the /shut_set.asp web interface of D‑Link DI‑8003 firmware 16.07.26A1. A malicious payload supplied in that parameter can overflow the buffer, potentially allowing an attacker to inject code or crash the device, leading to remote execution or denial of service.

The flaw affects D‑Link DI‑8003 routers running firmware version 16.07.26A1.

The vulnerability is publicly documented on D‑Link’s security bulletin page, yet no official patch or mitigation has been published at the time of reporting. The EPSS score is unavailable and the issue is not listed in the KEV catalog. An attacker would likely target the device over the network, sending a specially crafted vlan_name string to the /shut_set.asp endpoint while authenticated to the web interface. Successful exploitation could grant the attacker arbitrary code execution or cause a denial of service.