CVE-2026-91001

CriticalCVSS 9.9

Published: 15/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Summary

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the DDNS Configuration component. Manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely, and the exploit has been released to the public and may be used for attacks.

Risk Assessment

A remote attacker can exploit the buffer overflow to execute code or cause a device crash. The public availability of the exploit increases the risk.

Recommendation

Update D-Link DI-8400 firmware to a version that fixes the vulnerability, or restrict access to the DDNS interface. Monitor for unusual requests to /ddns.asp.

Other vulnerabilities in D-Link DI-8400

CVE-2026-10206High
In D-Link DI-8400 up to version 16.07.26A1, a stack-based buffer overflow exists in /dbsrv.asp when manipulating the str argument. Remote exploitation is possible. The exploit is public. The researcher noted conflicting parameter names.

Original NVD description (English source)

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.