CVE-2026-10206
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In D-Link DI-8400 up to version 16.07.26A1, a stack-based buffer overflow exists in /dbsrv.asp when manipulating the str argument. Remote exploitation is possible. The exploit is public. The researcher noted conflicting parameter names.
Risk Assessment
An attacker can remotely crash the device or potentially execute arbitrary code, leading to full compromise of the router and network.
Recommendation
Update the D-Link DI-8400 firmware to the latest version. If no update is available, consider replacing the device.
Other vulnerabilities in D-Link DI-8400
See all- CVE-2026-101081Critical
A stack-based buffer overflow vulnerability has been discovered in D-Link DI-8400 version 16.07 in the function menu_nat_more_asp of the file menu_nat_more.asp (Web Administration Service component). Manipulation of the argument opt allows remote attack. The exploit is public.
- CVE-2026-91001Critical
A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the DDNS Configuration component. Manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely, and the exploit has been released to the public and may be used for attacks.
Original NVD description (English source)
A vulnerability was detected in D-Link DI-8400 up to 16.07.26A1. This affects an unknown function of the file /dbsrv.asp. Performing a manipulation of the argument str results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The initial researcher advisory mentions contradicting parameter names to be affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS