CVE-2025-50646
Published: 08 April 2026
Summary
CVE-2025-50646 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Di-8003 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces input validation on the 'name' parameter in the /qos_type_asp.asp endpoint to prevent buffer overflows from malformed requests.
Implements memory protections such as stack canaries or address space layout randomization to mitigate buffer overflow vulnerabilities like CWE-120 leading to memory corruption.
Requires timely remediation of identified flaws, such as applying D-Link firmware patches from advisories SAP10505 to eliminate the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing web endpoint (/qos_type_asp.asp) directly enables remote exploitation (T1190) and targeted application/system crash for DoS (T1499.004).
NVD Description
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to insufficient input validation on the name parameter in the /qos_type_asp.asp endpoint.
Deeper analysisAI
CVE-2025-50646 is a buffer overflow vulnerability (CWE-120) affecting the D-Link DI-8003 device on firmware version 16.07.26A1. The flaw arises from insufficient input validation on the "name" parameter handled by the /qos_type_asp.asp endpoint, potentially allowing memory corruption when processing malformed requests.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable over the network with low attack complexity, no privileges or user interaction required, and unchanged impact scope. An unauthenticated remote attacker can send a specially crafted request to the vulnerable endpoint, triggering the buffer overflow and causing a denial-of-service condition through device crash or reboot, with high availability impact but no direct confidentiality or integrity effects.
D-Link has published mitigation guidance in security advisories, including SAP10505 at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10505 and the security bulletin page at https://www.dlink.com/en/security-bulletin/. Further details appear in the IoT vulnerability collection on GitHub at https://github.com/xiaotea/iot-vulnerability-collection/blob/main/README.md.
Details
- CWE(s)