CVE-2025-50654
Published: 08 April 2026
Summary
CVE-2025-50654 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Dlink Di-8003 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the improper validation of the 'id' parameter in /thd_member.asp by enforcing comprehensive input validation to prevent buffer overflows.
Implements memory protections like address space layout randomization and stack guards to mitigate buffer overflow exploitation resulting in device crashes.
Mandates timely flaw remediation through firmware updates as provided in D-Link's SAP10505 advisory to eliminate the buffer overflow vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web endpoint directly enables remote unauthenticated application/system exploitation resulting in crash/reboot (DoS).
NVD Description
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper validation of the id parameter in the /thd_member.asp endpoint.
Deeper analysisAI
CVE-2025-50654 is a buffer overflow vulnerability (CWE-120) affecting the D-Link DI-8003 router on firmware version 16.07.26A1. The flaw arises from improper validation of the "id" parameter in the /thd_member.asp web endpoint, which can lead to memory corruption. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and was published on 2026-04-08T19:24:16.147.
Remote unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a specially crafted HTTP request targeting the vulnerable endpoint, an attacker can trigger the buffer overflow, resulting in a denial-of-service condition such as device crash or reboot, with high impact on availability but no effects on confidentiality or integrity.
D-Link has issued security advisories addressing this issue, including publication SAP10505 available at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10505 and the company's security bulletin page at https://www.dlink.com/en/security-bulletin/. Further details appear in community collections such as https://github.com/xiaotea/iot-vulnerability-collection/blob/main/README.md.
Details
- CWE(s)