A buffer overflow exists in the DI‑8003 router’s /url_group.asp endpoint due to improper handling of the name parameter. A crafted request to this handler can corrupt the device’s memory, potentially allowing an attacker to inject and execute arbitrary code. The result is a compromise of data confidentiality, integrity, and device availability.

D‑Link DI‑8003 routers running firmware 16.07.26A1. No other products or firmware versions are identified as vulnerable.

Although no CVSS score or EPSS figure is provided, the nature of the defect— a buffer overflow that can lead to remote code execution—implies very high severity. The flaw is reachable through the web administration interface, meaning local or remote attackers with network access to the router could exploit it. D‑Link has issued a security bulletin, suggesting that a firmware update exists to remediate the issue.