A buffer overflow flaw exists in the D‑Link DI‑8003 router’s web interface, specifically in the /xwgl_bwr.asp endpoint. The vulnerability is caused by improper handling of the name, qq, and time query parameters in an HTTP GET request. An attacker who can craft these parameters with oversized values can overflow the buffer, potentially corrupting memory and enabling arbitrary code execution, which would give the attacker control of the device.

The flaw affects D‑Link DI‑8003 routers running firmware version 16.07.26A1. No other firmware revisions or models are listed as impacted.

The attack vector is through the publicly reachable web administration interface, so an external attacker can reach the vulnerable endpoint over the network. No CVSS or EPSS metrics are provided, and the vulnerability is not listed in CISA’s KEV catalog. The lack of published scores does not diminish the risk, given that the buffer overflow could lead to remote code execution. Defenders should consider this flaw serious until an official fix is released.