Buffer overflow has been discovered in the /web_keyword.asp endpoint of the D-Link DI-8003 router, caused by improper handling of the name, en, time, mem_gb2312, and mem_utf8 parameters. An attacker can craft a malicious HTTP GET request that overflows a memory buffer, potentially enabling arbitrary code execution, threatening confidentiality, integrity, and availability of the device and any connected network.

The flaw exists in D-Link DI-8003 routers running firmware version 16.07.26A1. Current firmware releases beyond this version are not known to be affected.

Because the vulnerability can be triggered remotely via standard HTTP requests without authentication, the potential impact is high. The CVSS score is not publicly provided, but the nature of the buffer overflow and absence of mitigations indicate a high likelihood of exploitation. The flaw is not listed in CISA's Known Exploited Vulnerabilities catalog and EPSS metrics are unavailable. An attacker can exploit the vulnerability by sending a crafted request to the exposed endpoint, using the aforementioned parameters to trigger the buffer overflow.