A buffer overrun arises in D‑Link DI‑8003 firmware 16.07.26A1 when a web administrator sends overly long values in the name, qq, and time fields of the /xwgl_bwr.asp URL. The vulnerability originates from insufficient bounds checking, which can corrupt memory. The specified behavior is limited to memory corruption that may produce a device crash or loss of service; the description does not confirm arbitrary code execution, so any higher‑grade impact is inferred rather than stated.

The flaw is specific to DI‑8003 routers running firmware version 16.07.26A1. The affected endpoint is part of the router’s web management interface, which could be accessed locally or from the Internet if the device is exposed.

The metric set assigns a CVSS score of 7.5, indicating high severity. The EPSS value is reported as less than 1 %, meaning exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed active exploitation. The attack vector is remote over HTTP GET to the vulnerable parameters and does not require prior authentication; a crafted request suffices. Successful exploitation would likely lead to a device crash or service disruption rather than confirmed code execution.