This vulnerability (CVE-2026-91003) affects the D-Link DI-8300 device running firmware version 16.07. The issue lies in the rzgl_asp function within the /rzgl.asp CGI service, where manipulation of the redirct_url parameter leads to a stack-based buffer overflow. The vulnerability can be exploited remotely, and exploit code is publicly available. The CVSS 4.0 base score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, availability, and security controls at a high level.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device, compromising the confidentiality, integrity, and availability of the system. Given the critical CVSS score and the availability of exploit code, affected devices are at significant risk if exposed to untrusted networks.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict network access to the affected device's management interfaces and monitor for exploit attempts. Follow vendor communications closely for updates on patch availability.