CVE-2026-7851
HighCVSS 7.2Exploitation Probability (EPSS)
High risk90th percentile - higher than 90% of all known CVEs
Summary
A vulnerability was found in D-Link DI-8100 version 16.07.26A1. The sprintf function in the yyxz.asp file is prone to a stack-based buffer overflow via the ID argument. The attack can be performed remotely and a public exploit exists.
Risk Assessment
The organization risks remote code execution or device crash. The public availability of the exploit increases the likelihood of immediate attacks.
Recommendation
Update the D-Link DI-8100 firmware to the latest version immediately. If no update is available, restrict external network access to the device.
Other vulnerabilities in D-Link DI-8100
See all- CVE-2026-7856High
A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the web management interface (file /url_member.asp) allows remote exploitation via the Name argument. An exploit has been published.
- CVE-2026-7854Critical
A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the function url_rule_asp of the file /url_rule.asp (POST Parameter Handler) allows remote attackers to potentially execute arbitrary code. The exploit has been publicly disclosed.
- CVE-2026-7853Critical
A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp. Manipulation of the argument enable/time causes buffer overflow. The attack can be initiated remotely. The exploit has been made public.
- CVE-2026-7857High
A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the file /user_group.asp (CGI Handler) via the sprintf function allows remote exploitation. The exploit has been publicly disclosed.
- CVE-2026-7855High
Vulnerability in D-Link DI-8100 router version 16.07.26A1. The tggl_asp function in /tggl.asp is vulnerable to buffer overflow via manipulation of the Name argument. The attack can be carried out remotely.
Original NVD description (English source)
A vulnerability was identified in D-Link DI-8100 16.07.26A1. This affects the function sprintf of the file yyxz.asp. The manipulation of the argument ID leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.