Cyber & AI intelligence
Wasteland.
Briefs indexed2615
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-91003 2026-09-15

CVE-2026-91003: Stack-Based Buffer Overflow in D-Link DI-8300 CGI Service

"A published proof-of-concept exploit targets a critical stack-based buffer overflow in the D-Link DI-8300 router's CGI service, reachable remotely over the network."

A published proof-of-concept exploit targets a critical stack-based buffer overflow in the D-Link DI-8300 router's CGI service, reachable remotely over the network.

What Is It

CVE-2026-91003 is a stack-based buffer overflow in D-Link DI-8300 firmware version 16.07. The flaw sits in the rzgl_asp function of /rzgl.asp, part of the device's CGI Service component. An attacker manipulates the redirct_url argument to overflow a stack buffer.

NVD assigns a CVSS 3.1 base score of 9.1 (CRITICAL) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. The CVSS 4.0 secondary score is 8.5 (HIGH) with exploit maturity rated PROOF_OF_CONCEPT. The vulnerability is classified under CWE-119 (improper restriction of operations within memory buffer bounds) and CWE-121 (stack-based buffer overflow).

Why It Matters

Per the NVD description, remote exploitation is possible and the exploit has been published and may be used. Public exploit code, including a Python script, is available in the referenced GitHub repository, which lowers the barrier to opportunistic exploitation.

The scope-changed CVSS rating reflects that a successful overflow impacts resources beyond the vulnerable component itself. Both CVSS 3.1 and 4.0 vectors do require high privileges (PR:H), and the CVSS 2.0 vector lists Au:M (multiple authentication instances), so an attacker needs authenticated access to reach the flaw.

This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog based on the supplied data; no KEV entry was provided, so there is no confirmed in-the-wild exploitation or federal remediation deadline associated with it at this time.

What's Vulnerable

Patch Status

The supplied source material contains no vendor advisory, patch reference, or fixed version. The only D-Link reference provided is the vendor's main website. No required action or remediation deadline is specified in the available data. The record's NVD status is Received, published 2026-09-15, meaning it has not yet completed NVD analysis.

Sources