CVE-2025-50664
Published: 08 April 2026
Summary
CVE-2025-50664 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Dlink Di-8003 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation of HTTP GET parameters (name, mem, pri, attr) at the /user_group.asp endpoint to prevent buffer overflow exploitation.
Implements memory protections like stack canaries and address space randomization to mitigate buffer overflow impacts on the vulnerable firmware.
Requires timely application of D-Link firmware patches from security advisory SAP10505 to remediate the known buffer overflow flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated web endpoint directly enables remote exploitation of public-facing application (T1190) resulting in DoS via crafted HTTP request (T1499.004).
NVD Description
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /user_group.asp endpoint. The attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, mem, pri, and attr.
Deeper analysisAI
CVE-2025-50664 is a buffer overflow vulnerability (CWE-121) affecting the D-Link DI-8003 device on firmware version 16.07.26A1. The flaw stems from improper handling of parameters in the /user_group.asp web endpoint, which can be triggered via HTTP requests.
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP GET request with manipulated parameters including name, mem, pri, and attr. The attack requires low complexity and no user interaction, is accessible over the network, and results in high availability impact with no effects on confidentiality or integrity, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). This typically leads to a denial-of-service condition, such as device crash or reboot.
D-Link has published security advisory SAP10505 at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10505 and maintains a security bulletin page at https://www.dlink.com/en/security-bulletin/. Further details appear in an IoT vulnerability collection on GitHub at https://github.com/xiaotea/iot-vulnerability-collection/blob/main/README.md. Practitioners should review these advisories for patch availability and mitigation guidance.
Details
- CWE(s)