Which versions of D-Link DI-8100 are affected by CVE-2026-7248?

D-Link DI-8100 routers running firmware 16.07.26A1 are vulnerable to unauthenticated remote code execution via a buffer overflow in the web management interface, exposing any internet-facing device…

How to fix or mitigate CVE-2026-7248?

Within 24 hours: Identify and inventory all D-Link DI-8100 routers running firmware version 16.07.26A1 in your environment; immediately isolate affected devices from internet-facing access and restrict administrative access to trusted networks only. Within 7 days: Contact D-Link support to confirm available firmware updates beyond 16.07.26A1 and test in a controlled environment; if no newer firmware is available, implement network segmentation to prevent direct internet access to the router's web interface. Within 30 days: Deploy a replacement device from a vendor with an active security update program, or maintain compensating controls indefinitely if replacement is not feasible.

D-Link DI-8100 CVE-2026-7248

Q: What is the CVSS score of CVE-2026-7248?

CVE-2026-7248 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26019 HIGH

Buffer Overflow (CWE-119)

2026-04-28 cna@vuldb.com

Buffer Overflow D-Link

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:38 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 09:32 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 09:22 euvd

EUVD-2026-26019

Analysis Generated

Apr 28, 2026 - 09:22 vuln.today

CVE Published

Apr 28, 2026 - 09:16 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was found in D-Link DI-8100 16.07.26A1. This affects the function tgfile_htm of the file tgfile.htm of the component CGI Endpoint. The manipulation of the argument fn results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

Remote code execution in D-Link DI-8100 router firmware 16.07.26A1 allows unauthenticated attackers to compromise the device via buffer overflow in the CGI endpoint. The vulnerability resides in the tgfile.htm CGI handler where inadequate input validation of the 'fn' parameter enables attackers to overflow a stack or heap buffer. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation against internet-exposed devices. CVSS 8.9 (Critical) with network vector, low complexity, and no privileges required indicates high real-world risk for exposed D-Link DI-8100 routers.

Technical ContextAI

This is a classic buffer overflow (CWE-119) in embedded device CGI code. The DI-8100 is a multi-WAN VPN router designed for small/medium business use. The tgfile.htm CGI endpoint, likely part of the web management interface, processes the 'fn' parameter without proper bounds checking before copying it into a fixed-size buffer. CGI-based vulnerabilities in network devices are particularly severe because the web interface typically runs with root or administrative privileges and is often exposed to WAN interfaces for remote management. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable without authentication over the network, with low attack complexity. The affected CPE would be cpe:2.3:o:dlink:di-8100_firmware:16.07.26a1, indicating firmware version 16.07.26A1 is vulnerable.

RemediationAI

Check D-Link's official support site (https://www.dlink.com/) for a patched firmware version newer than 16.07.26A1. No vendor-released patch version is confirmed from available data as of this analysis. If no patch is available or the DI-8100 has reached end-of-life, implement compensating controls immediately: disable remote web management access from WAN interfaces and restrict administrative access to trusted internal IP addresses only via firewall rules (accept trade-off of reduced remote management convenience). If remote management is required, place the device behind a VPN gateway requiring strong authentication. Consider replacing the DI-8100 with actively supported hardware if D-Link has discontinued security updates for this model. Monitor authentication logs for repeated failed login attempts or unusual administrative access patterns indicating exploitation attempts. For detailed vulnerability specifics that can inform IDS signatures, review https://vuldb.com/vuln/359857.