CVE-2025-50659
Published: 08 April 2026
Summary
CVE-2025-50659 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Di-8003 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces validation of the custom_error parameter at the /user.asp endpoint to prevent buffer overflow exploitation.
Requires identification, reporting, and patching of the buffer overflow flaw via D-Link firmware update SAP10505.
Provides denial-of-service protections to mitigate availability impacts from crafted requests triggering device crashes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web endpoint directly enables remote unauthenticated exploitation causing system crash/reboot (DoS).
NVD Description
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the custom_error parameter in the /user.asp endpoint.
Deeper analysisAI
CVE-2025-50659 is a buffer overflow vulnerability (CWE-121) in the D-Link DI-8003 device running firmware version 16.07.26A1. The flaw arises from improper handling of the custom_error parameter in the /user.asp endpoint, resulting in a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Remote attackers require no authentication or user interaction to exploit this vulnerability over the network with low complexity. By sending crafted requests to the affected endpoint, they can trigger the buffer overflow, achieving a denial-of-service condition through high availability impact, such as device crashes or reboots.
D-Link has issued security advisories for this issue, including publication SAP10505 at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10505 and general security bulletins at https://www.dlink.com/en/security-bulletin/. The vulnerability is also documented in the IoT vulnerability collection on GitHub at https://github.com/xiaotea/iot-vulnerability-collection/blob/main/README.md. Security practitioners should review these resources for patching and mitigation guidance.
Details
- CWE(s)