The vulnerability is a classic buffer overflow caused by improper handling of the name parameter in the /usb_paswd.asp endpoint of the D-Link DI-8003. This flaw can overwrite the stack and allow an attacker to inject and execute arbitrary code, giving control over the device. The impact is loss of confidentiality, integrity, and availability, potentially leading to full system compromise.

Affected device is the D-Link DI-8003 with firmware version 16.07.26A1. The flaw exists in the HTTP interface that processes the /usb_paswd.asp request. No other firmware versions or product lines are listed.

The CVSS score of 7.5 categorizes the flaw as high severity. The EPSS score below 1% suggests the probability of exploitation is currently low, and the vulnerability is not yet reported in the CISA KEV catalog. Attacks would likely originate from an attacker who can reach the device’s web interface, delivering a crafted request that triggers the overflow. The lack of a public exploit and low EPSS score reduce immediate threat, but the potential for remote code execution makes it a priority for patching.