EUVD-2026-33528
GHSA-h983-438c-387c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed DI-8400 web UI
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend oversized 'str' parameter to /dbsrv.asp
-
ExecutionOverflow stack buffer and hijack return address
-
PersistExecute shellcode on router
-
ImpactPivot or enroll in botnet
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have network reachability to the router's web management interface (HTTP/HTTPS, typically port 80/443) and a valid low-privilege web UI account (CVSS PR:L), with no user interaction required. The vulnerable endpoint /dbsrv.asp must be accessible - by default this is exposed on the LAN, and if WAN-side remote management is enabled it becomes internet-reachable. Exploitation is limited to D-Link DI-8400 devices running firmware up to 16.07.26A1; the precise vulnerable parameter is ambiguous per the researcher (advisory contradicts the 'str' label), so a payload targeting only the literal 'str' field may not trigger the bug on every firmware build. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability of the device itself (scope-changed metrics are N), yielding a base score of 7.4. The E:P (Proof-of-Concept) threat metric aligns with the confirmed public exploit on GitHub, materially elevating real-world risk above a theoretical CVSS rating. No EPSS score, KEV listing, or SSVC decision is supplied in the input, so widespread automated exploitation cannot be confirmed - however, D-Link router bugs with public PoCs are historically attractive to botnet operators (Mirai-family). A notable caveat: the description itself states the researcher advisory mentions 'contradicting parameter names,' meaning the exact vulnerable parameter ('str' vs. another) is not fully confirmed; defenders should treat all parameters of /dbsrv.asp as suspect rather than filtering only on 'str.' |
| Exploit ScenarioDerived | An attacker with low-privileged credentials to the router's web UI (obtained via default credentials, prior phishing, or credential reuse) sends a crafted HTTP request to /dbsrv.asp with an oversized value in the 'str' parameter (or a related parameter, given the researcher's noted ambiguity), overflowing a stack buffer and overwriting the saved return address to redirect execution. Because publicly available exploit code exists on GitHub, the barrier to weaponization is low, and successful exploitation can yield arbitrary code execution on the router, enabling traffic interception, pivoting into the internal network, or enrollment in a botnet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 01, 2026
Stack-based buffer overflow in D-Link DI-8400 routers through firmware 16.07.26A1 allows authenticated remote attackers to corrupt memory by manipulating the 'str' parameter in /dbsrv.asp, potentially achieving code execution on the device. Publicly available exploit code exists, raising the practical risk despite the requirement for low-level privileges per the CVSS 4.0 vector. The original researcher advisory notes contradictory parameter names, introducing some uncertainty about the exact trigger field.
Earlier versions of this analysis (2)
Stack-based buffer overflow in D-Link DI-8400 routers (firmware through 16.07.26A1) allows authenticated remote attackers to corrupt memory by submitting a crafted 'str' parameter to /dbsrv.asp, with publicly available exploit code increasing near-term risk. CVSS 4.0 scores this 7.4 with high impact to confidentiality, integrity, and availability, though no active exploitation is recorded in CISA KEV. The original researcher advisory cites contradicting parameter names, so the exact trigger field should be verified against the published PoC.
Stack-based buffer overflow in D-Link DI-8400 routers through firmware 16.07.26A1 allows authenticated remote attackers to corrupt memory by submitting a crafted 'str' parameter to /dbsrv.asp, potentially achieving code execution on the device. Publicly available exploit code exists (published via VulDB and a GitHub PoC), elevating real-world risk despite the requirement for low-privilege access. The CVSS 3.1 base score is 8.8 (High) with a network attack vector and low complexity.
RemediationAI
No vendor-released patch identified at time of analysis; the D-Link advisory page (https://www.dlink.com/) should be monitored for a firmware release superseding 16.07.26A1. As compensating controls, restrict access to the router's web management interface to a trusted management VLAN or specific admin workstations and disable any WAN-side (remote) management to eliminate the network attack surface - note that this prevents legitimate remote administration. Place the /dbsrv.asp endpoint behind a reverse proxy or WAF that enforces strict length limits on all request parameters (the researcher noted parameter-name ambiguity, so filter broadly rather than only on 'str'); the trade-off is added latency and potential breakage of legitimate management workflows. Rotate administrative credentials (PR:L exploitation requires a low-privilege account) and audit for unexpected admin accounts. Public exploit details are referenced at https://github.com/666324/dlink-di8400-vuln and https://vuldb.com/vuln/367486/cti.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected device is the D-Link DI-8400, a multi-WAN business router, identified by CPE cpe:2.3:a:d-link:di-8400 across all versions up to 16.07.26A1. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), where input supplied to the 'str' argument of the /dbsrv.asp endpoint is written to a fixed-size stack buffer without proper bounds checking. Like many SOHO/SMB router web-management bugs, this stems from C-based ASP handlers in the embedded HTTP server copying user-controlled query/post data into local buffers via unsafe string functions, enabling overwrite of saved return addresses or adjacent stack data and likely leading to arbitrary code execution in the router's web management process.
Know when Di 8400 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in D-Link DI-8400 up to 16.07.26A1. This affects an unknown function of the file /dbsrv.asp. Performing a manipulation of the argument str results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The initial researcher advisory mentions contradicting parameter names to be affected.
Executive ViewAI
D-Link DI-8400 routers (firmware ≤16.07.26A1) contain a stack buffer overflow in the administrative interface that could allow authenticated attackers to execute code on the device; publicly available exploit code exists and no vendor patch is currently available, creating immediate risk for organizations relying on these devices for network access and management.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict administrative access to affected devices through network firewalls and VPN gating; (2) Enforce strong multi-factor authentication on all administrative accounts; (3) Disable remote management protocols (SSH, HTTPS admin access) if not operationally critical; (4) Implement network segmentation to contain compromised devices; (5) Monitor administrative authentication logs and network traffic for exploitation attempts; (6) Prepare contingency plans and procurement timeline for replacement devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overw
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows a high-privileged, authenticated remote
Exploit-DB