D-Link DI-8400 CVE-2026-101081

Requires high-privileged authenticated access to the D-Link DI-8400 (firmware 16.07) Web Administration Service; the attacker must reach the menu_nat_more.asp endpoint and supply a manipulated 'opt' argument to trigger the stack overflow in menu_nat_more_asp. Exploitation is remote over the network (AV:N) with low complexity and no user interaction, but is limited by the PR:H requirement - admin credentials must already be held - and by the router's management interface being reachable (typically LAN-side unless remote administration is enabled, which further narrows exposure). Only DI-8400 16.07 is confirmed affected.

The provided CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N, VC/VI/VA:H) and E:P (proof-of-concept exploit maturity) yield an 8.5, but two signals temper real-world urgency. First, PR:H means exploitation requires high-privileged (administrative) authentication to the router's Web Administration Service, so this is a post-authentication memory-corruption bug, not a pre-auth internet worm. Second, the subsequent-system impact metrics (SC:H/SI:H/SA:H) are almost certainly scope-inflated by the VulDB submission process - a stack overflow inside a single embedded web server compromises that device, not a distinct downstream system, so a more defensible vector drops the SC/SI/SA to N. No EPSS score, no CISA KEV listing, and no evidence of active exploitation are present in the input; the only exploitation signal is publicly available PoC code (a Python script in the Vivi-Xray GitHub repo). Net: a genuine remotely-triggerable RCE-class flaw with public PoC, but gated behind admin credentials on a low-footprint SOHO router - realistically a medium-priority patch/mitigation item, not a drop-everything emergency, and lower than the 8.5 suggests.

An attacker who has obtained (or defaulted/brute-forced) administrative credentials to a D-Link DI-8400 web admin panel sends a crafted request to menu_nat_more.asp with an oversized 'opt' argument, overflowing a stack buffer in menu_nat_more_asp. A public Python PoC (manu_nat_more_asp.py) already demonstrates the crash, and a reliable exploit could achieve code execution on the router or at minimum a denial of service. Because the CVSS vector is PR:H, this is realistic only after the attacker holds admin access (e.g., via weak/default credentials, credential reuse, or a chained auth bypass).