CVE-2025-50652 D-Link CVE debrief

Who should care

Security teams and administrators responsible for D-Link DI-8003 devices should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing and applying the vendor's security bulletin and mitigation guidance, inventorying and assessing D-Link DI-8003 devices for exposure, and implementing compensating controls if patching is not feasible.

Technical summary

The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness is related to CWE-120. The affected product is D-Link DI-8003 16.07.26A1, and the vulnerability is related to improper handling of the id parameter in the /saveparm_usb.asp endpoint. This vulnerability can be exploited remotely without authentication, and high priority should be given to patching or mitigating this vulnerability.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it can be exploited remotely without authentication.

Recommended defensive actions

• Review and apply the vendor's security bulletin and mitigation guidance.
• Inventory and assess D-Link DI-8003 devices for exposure.
• Implement compensating controls, such as monitoring and exception tracking, if patching is not feasible.
• Verify the effectiveness of existing security controls and configurations.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail provide limited information about the vulnerability. Further investigation and verification are necessary to fully understand the scope and impact of this vulnerability. The affected product, D-Link DI-8003 16.07.26A1, and its improper handling of the id parameter in the /saveparm_usb.asp endpoint, may pose a risk to organizations using this device. Security teams should verify the effectiveness of existing security controls and configurations. Additional review of vendor documentation and security bulletins is recommended.

Official resources