Which versions of D-Link DI-8400 are affected by CVE-2026-10206?

D-Link DI-8400 routers (firmware ≤16.07.26A1) contain a stack buffer overflow in the administrative interface that could allow authenticated attackers to execute code on the device; publicly…

Is there a public PoC exploit available for CVE-2026-10206?

Yes, a public proof-of-concept exploit is available for CVE-2026-10206. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10206?

Within 24 hours: Inventory all D-Link DI-8400 routers running firmware 16.07.26A1 or earlier in your environment; immediately restrict administrative access to these devices via firewall rules and disable remote management if not operationally required. Within 7 days: Implement network segmentation to isolate affected routers from critical infrastructure; enforce multi-factor authentication on all administrative accounts; monitor device logs for suspicious login activity. Within 30 days: Check D-Link security advisories weekly for emergency firmware patches; begin procurement process to replace affected routers if no patch is released; evaluate alternative network equipment from vendors with active security update cycles.

D-Link DI-8400 CVE-2026-10206

Q: What is the CVSS score of CVE-2026-10206?

CVE-2026-10206 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33528 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-01 VulDB

GHSA-h983-438c-387c

Buffer Overflow D-Link Stack Overflow Di 8400

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 01, 2026 - 01:27 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 01, 2026 - 01:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 01, 2026 - 01:22 vuln.today

cvss_changed

CVSS changed

Jun 01, 2026 - 01:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 01, 2026 - 00:41 vuln.today

DescriptionCVE.org

A vulnerability was detected in D-Link DI-8400 up to 16.07.26A1. This affects an unknown function of the file /dbsrv.asp. Performing a manipulation of the argument str results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The initial researcher advisory mentions contradicting parameter names to be affected.

AnalysisAI

Stack-based buffer overflow in D-Link DI-8400 routers through firmware 16.07.26A1 allows authenticated remote attackers to corrupt memory by manipulating the 'str' parameter in /dbsrv.asp, potentially achieving code execution on the device. Publicly available exploit code exists, raising the practical risk despite the requirement for low-level privileges per the CVSS 4.0 vector. The original researcher advisory notes contradictory parameter names, introducing some uncertainty about the exact trigger field.

Technical ContextAI

The affected device is the D-Link DI-8400, a multi-WAN business router, identified by CPE cpe:2.3:a:d-link:di-8400 across all versions up to 16.07.26A1. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), where input supplied to the 'str' argument of the /dbsrv.asp endpoint is written to a fixed-size stack buffer without proper bounds checking. Like many SOHO/SMB router web-management bugs, this stems from C-based ASP handlers in the embedded HTTP server copying user-controlled query/post data into local buffers via unsafe string functions, enabling overwrite of saved return addresses or adjacent stack data and likely leading to arbitrary code execution in the router's web management process.

RemediationAI

No vendor-released patch identified at time of analysis; the D-Link advisory page (https://www.dlink.com/) should be monitored for a firmware release superseding 16.07.26A1. As compensating controls, restrict access to the router's web management interface to a trusted management VLAN or specific admin workstations and disable any WAN-side (remote) management to eliminate the network attack surface - note that this prevents legitimate remote administration. Place the /dbsrv.asp endpoint behind a reverse proxy or WAF that enforces strict length limits on all request parameters (the researcher noted parameter-name ambiguity, so filter broadly rather than only on 'str'); the trade-off is added latency and potential breakage of legitimate management workflows. Rotate administrative credentials (PR:L exploitation requires a low-privilege account) and audit for unexpected admin accounts. Public exploit details are referenced at https://github.com/666324/dlink-di8400-vuln and https://vuldb.com/vuln/367486/cti.