A published proof-of-concept exploit targets a critical stack-based buffer overflow in the D-Link DI-8300 router's CGI service, reachable remotely over the network.
What Is It
CVE-2026-91003 is a stack-based buffer overflow in D-Link DI-8300 firmware version 16.07. The flaw sits in the rzgl_asp function of /rzgl.asp, part of the device's CGI Service component. An attacker manipulates the redirct_url argument to overflow a stack buffer.
NVD assigns a CVSS 3.1 base score of 9.1 (CRITICAL) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact. The CVSS 4.0 secondary score is 8.5 (HIGH) with exploit maturity rated PROOF_OF_CONCEPT. The vulnerability is classified under CWE-119 (improper restriction of operations within memory buffer bounds) and CWE-121 (stack-based buffer overflow).
Why It Matters
Per the NVD description, remote exploitation is possible and the exploit has been published and may be used. Public exploit code, including a Python script, is available in the referenced GitHub repository, which lowers the barrier to opportunistic exploitation.
The scope-changed CVSS rating reflects that a successful overflow impacts resources beyond the vulnerable component itself. Both CVSS 3.1 and 4.0 vectors do require high privileges (PR:H), and the CVSS 2.0 vector lists Au:M (multiple authentication instances), so an attacker needs authenticated access to reach the flaw.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog based on the supplied data; no KEV entry was provided, so there is no confirmed in-the-wild exploitation or federal remediation deadline associated with it at this time.
What's Vulnerable
- Vendor: D-Link
- Product: DI-8300 (hardware)
- Affected version: 16.07
- Affected component: CGI Service,
/rzgl.asp, functionrzgl_asp - Affected parameter:
redirct_url - CPE:
cpe:2.3:h:d-link:di-8300:*:*:*:*:*:*:*:*
Patch Status
The supplied source material contains no vendor advisory, patch reference, or fixed version. The only D-Link reference provided is the vendor's main website. No required action or remediation deadline is specified in the available data. The record's NVD status is Received, published 2026-09-15, meaning it has not yet completed NVD analysis.
Sources
- NVD, CVE-2026-91003: https://nvd.nist.gov/vuln/detail/CVE-2026-91003
- VulDB, CVE-2026-91003: https://vuldb.com/cve/CVE-2026-91003
- VulDB, Entry 403586: https://vuldb.com/vuln/403586
- VulDB, Entry 403586 CTI: https://vuldb.com/vuln/403586/cti
- VulDB, Submission 932002: https://vuldb.com/submit/932002
- Researcher writeup (Vivi-Xray): https://github.com/Vivi-Xray/Xray-s-cve-/blob/main/rzgl/rzgl_asp.md
- Proof-of-concept script: https://github.com/Vivi-Xray/Xray-s-cve-/blob/main/rzgl/rzgl_asp.py
- D-Link: https://www.dlink.com/