CVE-2025-50661
Published: 08 April 2026
Summary
CVE-2025-50661 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Di-8003 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces validation of crafted HTTP GET parameters (name, en, ips, u, time, act, rpri, log) to prevent buffer overflows from improper input handling in the /url_rule.asp endpoint.
Requires timely remediation of the identified buffer overflow flaw via firmware patches from D-Link security advisory SAP10505.
Implements memory safeguards such as stack canaries, ASLR, and DEP to protect against exploitation of the stack-based buffer overflow (CWE-121).
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated public web endpoint directly enables remote exploitation of public-facing application (T1190) resulting in DoS via application exploitation (T1499.004).
NVD Description
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /url_rule.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, en, ips, u, time,…
more
act, rpri, and log.
Deeper analysisAI
CVE-2025-50661 is a buffer overflow vulnerability (CWE-121) affecting the D-Link DI-8003 router on firmware version 16.07.26A1. The flaw stems from improper handling of multiple parameters in the /url_rule.asp web endpoint, which can be triggered via HTTP GET requests.
An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. By sending a crafted HTTP GET request with the parameters name, en, ips, u, time, act, rpri, and log, the attacker can trigger the buffer overflow, resulting in a denial-of-service condition due to high availability impact, as reflected in the CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
D-Link has published security advisory SAP10505 addressing this issue, accessible via their support announcement page. Further details appear in the company's general security bulletin and IoT vulnerability collections, such as the GitHub repository at xiaotea/iot-vulnerability-collection.
Details
- CWE(s)