CVE-2025-50652
Published: 08 April 2026
Summary
CVE-2025-50652 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Di-8003 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the 'id' parameter size and format in /saveparm_usb.asp to directly prevent CWE-120 buffer overflows from malformed inputs.
Implements denial-of-service protections to block or limit the impact of remote unauthenticated buffer overflow exploits causing device crashes or reboots.
Mandates timely remediation of the identified buffer overflow flaw via D-Link firmware patches referenced in SAP10505 to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated web endpoint enables remote exploitation of public-facing application for DoS via system/application crash.
NVD Description
An issue in D-Link DI-8003 16.07.26A1 related to improper handling of the id parameter in the /saveparm_usb.asp endpoint.
Deeper analysisAI
CVE-2025-50652 affects the D-Link DI-8003 device running firmware version 16.07.26A1. The vulnerability arises from improper handling of the "id" parameter in the /saveparm_usb.asp endpoint, classified as CWE-120 (Buffer Copy without Checking Size of Input). It received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and was published on 2026-04-08.
Remote attackers require no authentication or privileges and can exploit the issue over the network with low attack complexity and no user interaction. Exploitation leads to a high-impact denial of service, potentially causing device crashes or reboots, while having no effect on confidentiality or integrity.
D-Link has issued security advisories addressing this vulnerability, including publication SAP10505 at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10505 and details on their security bulletin page at https://www.dlink.com/en/security-bulletin/. Further references appear in the IoT vulnerability collection on GitHub at https://github.com/xiaotea/iot-vulnerability-collection/blob/main/README.md.
Details
- CWE(s)