Remote Buffer Overflow Vulnerability in D-Link DI-8300

D-Link DI-8300 version 16.07 is affected by a stack-based buffer overflow vulnerability (CVE-2026-91003) residing within the CGI service component. The vulnerability is triggered through the 'rzgl_asp' function located in the '/rzgl.asp' endpoint. By providing a specially crafted input to the 'redirct_url' argument, an unauthenticated remote attacker can cause a buffer overflow, potentially leading to arbitrary code execution or a denial of service on the device. Proof-of-concept exploit code has been publicly released, increasing the risk of exploitation by opportunistic threat actors. Organizations utilizing this hardware must restrict access to management interfaces to trusted network segments or isolate the devices until a firmware resolution is provided by the vendor.

Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary code with the privileges of the CGI service on the D-Link DI-8300 router. This could result in a full compromise of the device, enabling traffic interception, lateral movement into internal networks, or permanent denial of service. The vulnerability carries a CVSS v3.1 base score of 9.1, reflecting the severity of remote code execution on core network infrastructure.

Recommendation

Prioritize the isolation of the D-Link DI-8300 management interface from the public internet. Ensure that network ingress to the device is restricted to trusted administrative IP addresses via firewall rules. Monitor internal logs for suspicious POST requests targeting '/rzgl.asp' with anomalous lengths in the 'redirct_url' parameter.