CVE-2025-50648
Published: 08 April 2026
Summary
CVE-2025-50648 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Di-8003 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the inadequate input validation in the /tggl.asp endpoint that enables the buffer overflow vulnerability.
Requires timely identification and remediation of the buffer overflow flaw through firmware patching as provided in D-Link advisories.
Protects against and detects denial-of-service effects like device crashes or reboots triggered by exploitation of this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public network endpoint directly enables application/system exploitation resulting in DoS via crashes/reboots.
NVD Description
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to inadequate input validation in the /tggl.asp endpoint.
Deeper analysisAI
CVE-2025-50648 is a buffer overflow vulnerability (CWE-120) affecting the D-Link DI-8003 device running firmware version 16.07.26A1. The flaw arises from inadequate input validation in the /tggl.asp endpoint and was published on 2026-04-08.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable remotely over the network with low attack complexity, requiring no privileges or user interaction. Unauthenticated attackers can send crafted requests to the vulnerable endpoint, triggering the buffer overflow and causing a denial-of-service condition that disrupts device availability, such as through crashes or reboots.
D-Link has published security advisories addressing this issue, including SAP10505 at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10505 and details in their security bulletin at https://www.dlink.com/en/security-bulletin/. Further information appears in an IoT vulnerability collection on GitHub at https://github.com/xiaotea/iot-vulnerability-collection/blob/main/README.md.
Details
- CWE(s)