An improper handling of the id parameter in the /saveparm_usb.asp endpoint of the D‑Link DI‑8003 router allows an attacker to alter device configuration settings without proper authorization, resulting in unauthorized changes to the USB storage settings.

This vulnerability is specific to D‑Link DI‑8003 routers running firmware version 16.07.26A1, and devices with older firmware versions that reuse the same code path may also be affected.

The CVSS score is not provided and the EPSS score is unavailable, so precise risk quantification is difficult. However, the endpoint is exposed via the web interface, making it reachable over the Internet without requiring physical access. An attacker could send a crafted HTTP request with a malicious id value to manipulate configuration. Although no public exploits have been documented and the vulnerability is not listed in the CISA KEV catalog, the potential for unauthorized configuration change suggests a moderate to high risk if exploited.