D-Link DI-8003 Buffer Overflow Vulnerability in the User.asp Endpoint

A buffer overflow vulnerability has been identified in the D-Link DI-8003 router, specifically in the firmware version 16.07.26A1. The vulnerability arises from improper handling of the custom_error parameter in the /user.asp endpoint, which can be exploited to cause a stack overflow, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, resulting in a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send a request to the /user.asp endpoint with an excessively long custom_error parameter. This will trigger the buffer overflow by exceeding the allocated memory space for the parameter, causing a stack overflow.