The vulnerability is a classic stack-based buffer overflow in the D‑Link DI‑8003 router firmware version 16.07.26a1. The flaw arises when the device parses the name parameter sent to the /url_member.asp endpoint without proper bounds checking. Because the super‑user HTTP interface is reachable over the network, an unauthenticated attacker could supply an oversized payload that overwrites return addresses, potentially allowing them to inject and execute arbitrary code and gain full control of the device.

Affected devices are D‑Link’s DI‑8003 wireless routers running firmware 16.07.26A1. The vulnerability is exposed through the web‑based configuration interface and applies only to that specific firmware build, as identified by the CPE entries for the device (h:dlink:di-8003) and the firmware (o:dlink:di-8003_firmware:16.07.26a1).

The CVSS score of 7.5 indicates a high severity, but the EPSS value of less than 1% suggests a low probability that attackers have already exploited this flaw in the wild, and it is not listed in the CISA KEV catalog. Nonetheless, because the flaw is accessible via the publicly reachable configuration portal, it represents a significant risk if the device is exposed on the internet. Attackers need no special privileges beyond reaching the device over HTTP, but exploitation requires knowledge of the vulnerable endpoint and the ability to construct the overflow payload.