Description

A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redirct_url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-15T06:17:01.387Z",
  "pubdate": "2026-09-15T06:17:01.387Z",
  "executiveSummary": "The D-Link DI-8300 firmware version 16.07 contains a critical stack-based buffer overflow vulnerability within its CGI-based web management interface.\nThe flaw originates from the improper handling of user-supplied input provided to the 'redirct_url' parameter within the '/rzgl.asp' file, specifically processed by the 'rzgl_asp' function.\nA remote, unauthenticated attacker can trigger this overflow by sending a specially crafted HTTP request containing an oversized payload, leading to the corruption of the stack memory.\nThis vulnerability poses a significant risk as it allows for potential remote code execution (RCE) on the target device, potentially leading to a full system compromise, persistent unauthorized access, or device instability (Denial of Service).\nGiven that exploit code is publicly available, the risk of exploitation is high. Mitigation is complicated by the nature of embedded firmware, often necessitating network-level access control or physical decommissioning if patches are unavailable.",
  "technicalDetails": "The vulnerability resides in the CGI Service component of the D-Link DI-8300, version 16.07. The root cause is identified as an unsafe implementation of input validation within the 'rzgl_asp' function located in '/rzgl.asp'.\nWhen the CGI handler parses the 'redirct_url' argument, it fails to perform adequate bounds checking on the input data before copying it into a fixed-size buffer allocated on the stack. The function likely utilizes dangerous C library calls (such as strcpy or gets) that do not enforce length limits, allowing the attacker to overwrite adjacent stack memory, including the saved frame pointer and the return address.\nThe exploitation flow begins with the attacker crafting a malicious HTTP GET or POST request. By injecting a payload exceeding the buffer's capacity into the 'redirct_url' field, the attacker can hijack the execution flow of the 'rzgl_asp' process.\nBy controlling the return address, the attacker can redirect the instruction pointer to arbitrary code. This may involve traditional stack-based shellcode injection or Return-Oriented Programming (ROP) techniques, especially if the device employs Data Execution Prevention (DEP).\nSince this process runs within the context of the CGI web server, successful exploitation typically grants the attacker the privileges of the web service process, which, in embedded router environments, often operates with administrative or root-level permissions.\nThe network exposure is high as the management interface is typically reachable over the local network or, if misconfigured, the public internet. Because the exploit is publicly available, the barrier to entry for an attacker is minimal, requiring only the ability to craft and send an HTTP request to the vulnerable endpoint. Post-exploitation, an attacker could establish a persistent backdoor, exfiltrate configuration data, modify firewall rules, or perform lateral movement within the network segment protected by the device."
}