CVE-2025-50649
Published: 08 April 2026
Summary
CVE-2025-50649 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Di-8003 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-50649 is a buffer overflow vulnerability (CWE-120) affecting the D-Link DI-8003 device on firmware version 16.07.26A1. The flaw arises from improper input validation in the vlan_name parameter processed by the /shut_set.asp endpoint, which can lead to memory corruption when malformed input exceeds buffer boundaries.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is exploitable remotely over the network with low attack complexity, no authentication requirements, and no user interaction needed. Unauthenticated attackers can send crafted requests to the vulnerable endpoint, triggering a denial-of-service condition that disrupts device availability, such as causing crashes or reboots, without impacting confidentiality or integrity.
D-Link has issued security advisories for mitigation, including publication SAP10505 at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10505 and details on their security bulletin page at https://www.dlink.com/en/security-bulletin/. The issue is also referenced in the IoT vulnerability collection on GitHub at https://github.com/xiaotea/iot-vulnerability-collection/blob/main/README.md. Security practitioners should review these sources for firmware updates and recommended workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209331
Vulnerability details
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper input validation in the vlan_name parameter in the /shut_set.asp endpoint.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web endpoint (/shut_set.asp) directly enables remote unauthenticated exploitation (T1190) causing device DoS via memory corruption (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the root cause of improper input validation on the vlan_name parameter, preventing buffer overflows from malformed inputs.
Requires timely flaw remediation through firmware updates as recommended in D-Link's security advisory to eliminate the buffer overflow vulnerability.
Limits the effects of denial-of-service attacks triggered by remote exploitation of the buffer overflow, protecting device availability.