A buffer overflow flaw exists in the web interface of the D-Link DI-8003 router, affecting firmware version 16.07.26A1. The vulnerability arises when the /time_group.asp endpoint processes the name and mem parameters without proper bounds checking, leading to an out‑of‑bounds write (CWE‑120). An attacker who can reach this endpoint can send crafted input that overflows the buffer and potentially execute arbitrary code on the device, compromising confidentiality, integrity and availability.

The issue specifically targets D-Link DI-8003 units running firmware 16.07.26A1. The CPE data confirms that the vulnerable component is the web management interface exposed on the device’s internal network. No other device models or firmware versions are listed as affected.

The vulnerability carries a CVSS v3 score of 7.5, indicating high severity. Its EPSS is below 1 % and it is not present in CISA’s KEV catalog, suggesting that large‑scale exploitation has not yet been observed. Exploitation would require network access to the router’s internal management interface, likely through a local or remote connection to the device. While discovery of the flaw is straightforward, the low exploit probability combined with the potential for complete device compromise warrants urgent attention.