CVE-2026-101081
CriticalCVSS 9.1Summary
A stack-based buffer overflow vulnerability has been discovered in D-Link DI-8400 version 16.07 in the function menu_nat_more_asp of the file menu_nat_more.asp (Web Administration Service component). Manipulation of the argument opt allows remote attack. The exploit is public.
Risk Assessment
Remote buffer overflow could allow an attacker to execute arbitrary code or cause denial of service on the device. Public exploit increases the risk of active exploitation.
Recommendation
Apply firmware updates from the vendor if available. Restrict access to the administration panel from trusted networks and consider disabling remote management if not needed.
Other vulnerabilities in D-Link DI-8400
See all- CVE-2026-91001Critical
A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the DDNS Configuration component. Manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely, and the exploit has been released to the public and may be used for attacks.
- CVE-2026-10206High
In D-Link DI-8400 up to version 16.07.26A1, a stack-based buffer overflow exists in /dbsrv.asp when manipulating the str argument. Remote exploitation is possible. The exploit is public. The researcher noted conflicting parameter names.
Original NVD description (English source)
A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS