A buffer overflow flaw has been found in the radius_asp function of several D‑Link DI‑series routers. By supplying specially crafted values for the parameters rd_en, rd_auth, rd_acct, http_hadmin, http_hadminpwd, rd_key, or rd_ip, an attacker can overflow a buffer and crash the web service, resulting in a loss of availability. The weakness is a classic buffer overrun governed by CWE‑119.

The affected devices include D‑Link DI‑8003, DI‑8500, DI‑8003G, DI‑8200G, DI‑8200, DI‑8400, DI‑8004w, DI‑8100, and DI‑8100G routers. The firmware versions listed are v16.07.26A1, v17.12.21A1, and v17.12.20A1.

The vulnerability allows an attacker to cause a denial of service by sending a crafted HTTP request to the device’s web interface. The description mentions the parameters explicitly, so it is inferred that the attack can be performed remotely from the network and no prior authentication is required. No CVSS or EPSS score is provided, but the nature of the flaw suggests a reasonable likelihood of successful exploitation for an attacker who can reach the device. The issue is not listed in the CISA KEV catalog.