Executive brief
D-Link DI-8300 is a network appliance used for routing and connectivity. A stack-based buffer overflow in its CGI web interface allows remote attackers to crash the device or execute arbitrary code by sending a specially crafted HTTP request to the rzgl.asp page. Exploitation requires valid credentials but no other complex interaction, and working exploits have been published publicly.
Technical details
A stack-based buffer overflow exists in the rzgl_asp function within the /rzgl.asp CGI component of D-Link DI-8300 version 16.07. The vulnerability is triggered by an overly long base64-encoded value passed to the redirct_url parameter, which is decoded and copied into a fixed-size buffer without length validation. The attack requires valid session cookies (wys_userid and wys_passwd), but can be executed over the network against the device's web interface. An authenticated attacker can overwrite the stack to execute arbitrary code or crash the device. Public proof-of-concept code is available.
Affected products
- D-Link DI-8300 16.07
Timeline
- 2026-09-15: disclosed
- exploited: Public exploit code available on GitHub