A buffer overflow exists in the firmware version 16.07.26a1 of the D‑Link DI‑8003 router due to insufficient validation of the routes_static parameter sent to the /router.asp endpoint. An attacker who can supply a carefully crafted payload may overwrite adjacent memory and gain arbitrary code execution on the device, compromising confidentiality, integrity, and availability. The weakness aligns with the common vulnerability type CWE‑120.

D‑Link DI‑8003 routers running the firmware build 16.07.26a1 are impacted. Only this specific firmware revision is known to contain the flaw; newer releases may have addressed the issue. The vulnerability is identified by the common platform enumeration strings for both the hardware and firmware.

The flaw carries a CVSS base score of 7.5, marking it as high severity. The EPSS score is below 1 %, indicating that exploitation is not widespread, and it is not listed in the CISA KEV catalog. Nevertheless, attackers can reach the /router.asp endpoint via local network or remote management if the web interface is exposed, so the risk remains significant. While the precise attack path is not detailed, the lack of input size checks suggests that an adversary with network access could craft a request that overflows the buffer.