CVE-2025-50653
Published: 08 April 2026
Summary
CVE-2025-50653 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Di-8003 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediates the buffer overflow vulnerability by applying the vendor firmware patch referenced in D-Link advisory SAP10505.
Validates the 'name' and 'mem' parameters at the /time_group.asp endpoint to prevent buffer overflows from improper input handling.
Implements memory protection mechanisms like DEP and ASLR to mitigate buffer overflow exploits causing device crashes or reboots.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web endpoint (/time_group.asp) directly enables remote unauthenticated exploitation (T1190) leading to application/system crash via software vulnerability exploitation (T1499.004).
NVD Description
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name and mem parameters in the /time_group.asp endpoint.
Deeper analysisAI
CVE-2025-50653 is a buffer overflow vulnerability (CWE-120) in the D-Link DI-8003 firmware version 16.07.26A1. The issue stems from improper handling of the "name" and "mem" parameters in the /time_group.asp endpoint. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. Successful exploitation leads to denial of service, such as application crashes or device reboots, without affecting confidentiality or integrity.
D-Link has published a security advisory (SAP10505) at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10505 and maintains a security bulletin page at https://www.dlink.com/en/security-bulletin/. The vulnerability is also documented in an IoT vulnerability collection on GitHub at https://github.com/xiaotea/iot-vulnerability-collection/blob/main/README.md. Security practitioners should review these sources for patching guidance and mitigation steps.
Details
- CWE(s)