CVE-2026-7854
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the function url_rule_asp of the file /url_rule.asp (POST Parameter Handler) allows remote attackers to potentially execute arbitrary code. The exploit has been publicly disclosed.
Risk Assessment
A remote attacker can trigger a buffer overflow, potentially leading to arbitrary code execution on the router and full compromise of the network device.
Recommendation
Immediately update the D-Link DI-8100 firmware to the latest available version or consider replacing the device if no patch is provided.
Other vulnerabilities in D-Link DI-8100
See all- CVE-2026-7856High
A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the web management interface (file /url_member.asp) allows remote exploitation via the Name argument. An exploit has been published.
- CVE-2026-7853Critical
A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp. Manipulation of the argument enable/time causes buffer overflow. The attack can be initiated remotely. The exploit has been made public.
- CVE-2026-7857High
A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the file /user_group.asp (CGI Handler) via the sprintf function allows remote exploitation. The exploit has been publicly disclosed.
- CVE-2026-7855High
Vulnerability in D-Link DI-8100 router version 16.07.26A1. The tggl_asp function in /tggl.asp is vulnerable to buffer overflow via manipulation of the Name argument. The attack can be carried out remotely.
- CVE-2026-7851High
A vulnerability was found in D-Link DI-8100 version 16.07.26A1. The sprintf function in the yyxz.asp file is prone to a stack-based buffer overflow via the ID argument. The attack can be performed remotely and a public exploit exists.
Original NVD description (English source)
A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS