CVE-2025-50666

CVE-2025-50666 is a buffer overflow vulnerability affecting D-Link DI-8003 version 16.07.26A1, located in the /web_post.asp endpoint. The flaw stems from improper parameter handling in HTTP GET requests, specifically within the name, en, user_id, log, and time fields. This vulnerability allows remote attackers to trigger a denial of service condition without requiring authentication or user interaction. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH), with a network-based attack vector requiring no privileges or user involvement. While attack complexity is low, the impact is limited to availability, meaning successful exploitation would cause service disruption rather than unauthorized data access or integrity compromise. There is no current evidence of active exploitation or public exploit code availability. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) list, and community engagement remains minimal, as reflected in the low EPSS score of 0.0008 and FAUCET Risk Score of 38.0. Organizations running affected D-Link DI-8003 units should prioritize patching to mitigate potential denial of service attacks, though immediate threat level is moderate.