A buffer overflow occurs when an attacker supplies an overly long vlan_name string to the /shut_set.asp endpoint of the D‑Link DI‑8003 router. The lack of bounds checking corrupts the device’s memory and can allow execution of arbitrary code. This enables an attacker to gain full control of the router and compromise confidentiality, integrity, and availability of the network services on it.

D‑Link DI‑8003 router running firmware version 16.07.26A1. No other affected versions are listed.

The CVSS score of 7.5 reflects high severity. An EPSS rating below 1% indicates that exploitable activity is currently uncommon, and the vulnerability is not listed in the CISA KEV catalog. Attackers would reach the flaw remotely by sending crafted requests to /shut_set.asp, potentially through the web management interface. Because the exploit can trigger arbitrary code execution, it should be treated as a high‑risk issue despite the low current exploitation probability.