CVE-2026-91003

A remotely exploitable stack-based buffer overflow exists in the rzgl_asp function of the /rzgl.asp CGI handler in D-Link DI-8300 firmware 16.07. An attacker triggers the flaw by sending an overly long value in the redirct_url argument to the router's web-based CGI service, overflowing a stack buffer. Successful exploitation can yield full compromise of the router with high impact to confidentiality, integrity, and availability, and the CVSS:4.0 vector (8.5, AV:N/PR:H) suggests the attacker needs privileged (e.g., authenticated admin-level) access to the management interface. Only D-Link DI-8300 running version 16.07 is confirmed affected. The advisory notes an exploit may have been published, but no public proof-of-concept is confirmed and there is no evidence of exploitation in the wild or a CISA KEV listing.

What to do: Immediately remove the DI-8300's web management interface from internet exposure by restricting access to trusted LAN/VPN segments via firewall rules or ACLs, since no fixed firmware version is identified in the advisory. Check device logs and crash history for anomalous requests to /rzgl.asp containing unusually long redirct_url parameters, which would indicate exploit attempts. Given the age of the DI-8300 platform, plan to replace it with a currently supported router, as D-Link legacy models frequently stop receiving security patches.