Which versions of D-Link DI-8100 are affected by CVE-2026-7247?

D-Link DI-8100 routers running firmware 16.07.26A1 contain a buffer overflow vulnerability in the file extension handler that allows authenticated administrators to gain complete system control.

How to fix or mitigate CVE-2026-7247?

Within 24 hours: Inventory all D-Link DI-8100 routers and document current firmware versions; restrict administrative access to network admin personnel only and enforce strong unique passwords. Within 7 days: Contact D-Link support to confirm patch availability timeline for firmware versions beyond 16.07.26A1; implement network segmentation to isolate router management interfaces. Within 30 days: Deploy patched firmware immediately upon vendor release; if no patch is released within 30 days, evaluate router replacement or decommissioning.

D-Link DI-8100 CVE-2026-7247

Q: What is the CVSS score of CVE-2026-7247?

CVE-2026-7247 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26018 HIGH

Buffer Overflow (CWE-119)

2026-04-28 cna@vuldb.com

Buffer Overflow D-Link

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:38 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 09:32 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 09:22 euvd

EUVD-2026-26018

Analysis Generated

Apr 28, 2026 - 09:22 vuln.today

CVE Published

Apr 28, 2026 - 09:16 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability has been found in D-Link DI-8100 16.07.26A1. Affected by this issue is the function file_exten_asp of the file file_exten.asp of the component File Extension Handler. The manipulation of the argument Name leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

AnalysisAI

Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated administrators to execute arbitrary code remotely via crafted file extension names. The vulnerability affects the file_exten.asp File Extension Handler component, with a publicly available exploit (E:P in CVSS vector). While requiring high-privilege access (PR:H), successful exploitation grants complete system control (VC:H/VI:H/VA:H), and the attack complexity is low (AC:L). No CISA KEV listing indicates targeted rather than widespread exploitation despite public POC availability.

Technical ContextAI

This is a classic buffer overflow (CWE-119) in the D-Link DI-8100 multi-WAN VPN router's web administration interface. The vulnerable function file_exten_asp processes the 'Name' parameter in file_exten.asp without proper bounds checking, allowing attackers to write beyond allocated buffer boundaries. The File Extension Handler component likely manages allowed/blocked file types for firewall or content filtering features. D-Link DI-8100 is an enterprise-grade router combining load balancing, VPN, and firewall capabilities. Buffer overflows in embedded device web interfaces are particularly dangerous because they typically run with root/system privileges and lack modern exploit mitigations like ASLR or DEP common in general-purpose operating systems. The CVSS 4.0 vector indicates network-accessible exploitation with no attack complexity barriers beyond obtaining admin credentials.

RemediationAI

Check D-Link support site (https://www.dlink.com/) for firmware updates beyond version 16.07.26A1 for the DI-8100 model. D-Link has historically provided firmware updates through their support download portal organized by product model. Until patched firmware is confirmed available and deployed, implement compensating controls: (1) Restrict administrative interface access to trusted management networks only via firewall rules - block TCP ports 80/443 from WAN and untrusted networks, (2) Enforce strong unique passwords for all admin accounts and enable multi-factor authentication if supported, (3) Monitor authentication logs for failed login attempts indicating credential attacks, (4) If remote management is unnecessary, disable it entirely and require VPN access for administration. Note that disabling remote management impacts operational flexibility for distributed IT teams. Deploy network segmentation to limit blast radius if the router is compromised. The public exploit at https://github.com/draw-ctf/report/blob/main/DI-8100/file_exten_asp_overflow.md should be reviewed by security teams to understand exact exploitation mechanics for detection signature development.