The vulnerability is a classic buffer overflow caused by improper handling of the wan_ping parameter in the /wan_ping.asp endpoint of D‑Link DI‑8003 and DI‑8003G devices. A properly crafted input could overwrite adjacent memory, allowing an attacker to execute arbitrary code. This flaw exposes the device to remote compromise, potentially enabling full control of the network gateway.

The affected devices are D‑Link DI‑8003 running firmware version 16.07.26A1 and D‑Link DI‑8003G running firmware version 19.12.10A1. These models expose the vulnerable endpoint on the device’s web interface and are commonly used in small office and home‑office environments.

The CVSS score of 7.5 categorizes the vulnerability as high severity, while the EPSS score of less than 1% suggests that automated exploitation attempts are unlikely at present. The vulnerability is not listed in the CISA’s KEV catalog, indicating no known widespread exploitation yet. The most probable attack vector is remote, with an adversary sending a malicious request to the /wan_ping.asp page over the device’s exposed HTTP interface. An attacker would need network access to the device’s management interface and the ability to craft an oversized wan_ping value, which can feasibly be achieved from an internal or compromised network.