A buffer overflow exists in the /url_rule.asp endpoint of the D‑Link DI‑8003 router. Improper handling of nine HTTP GET parameters (name, en, ips, u, time, act, rpri, and log) can corrupt memory. This classic buffer overrun (CWE‑120/CWE‑119) enables an attacker who can send a crafted request to execute arbitrary code or crash the device.

The flaw is identified only on the D‑Link DI‑8003 model running firmware revision 16.07.26A1. No other D‑Link products are listed as affected.

The likely attack vector is remote HTTP traffic; an adversary can reach the vulnerable endpoint from the Internet if the router’s web interface is exposed. CSFC and EPSS data are unavailable, and the vulnerability is not included in the CISA KEV catalog, so an official severity rating is unknown. Nevertheless, the nature of the buffer overflow suggests the potential for full remote code execution or denial of service, placing the risk at a high level when the device is reachable from untrusted networks. Based on the description, it is inferred that exploitation would require sending a specially crafted GET request containing the vulnerable parameters.