Which versions of D-Link DI-8100 are affected by CVE-2026-7851?

D-Link DI-8100 router firmware 16.07.26A1 contains a stack-based buffer overflow vulnerability in the administrative interface that allows authenticated administrators to execute arbitrary code on…

Is there a public PoC exploit available for CVE-2026-7851?

Yes, a public proof-of-concept exploit is available for CVE-2026-7851. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-7851?

Within 24 hours: Identify all D-Link DI-8100 routers running firmware 16.07.26A1 in production and document their network location and administrative access controls. Within 7 days: Restrict administrative access to these devices to a minimal set of named administrators, enforce multi-factor authentication if supported, and segregate administrative management traffic to a protected network. Within 30 days: Contact D-Link support to confirm patch availability timeline; if no patch is released within 60 days, plan replacement of affected DI-8100 units with alternative router models that receive active security updates.

D-Link DI-8100 CVE-2026-7851

Q: What is the CVSS score of CVE-2026-7851?

CVE-2026-7851 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27416 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-05 VulDB

GHSA-x4pj-ppv6-g6w7

Stack Overflow D-Link Buffer Overflow

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 18:30 vuln.today

CVSS changed

May 05, 2026 - 18:22 NVD

7.2 (HIGH) 7.3 (HIGH)

DescriptionCVE.org

A vulnerability was identified in D-Link DI-8100 16.07.26A1. This affects the function sprintf of the file yyxz.asp. The manipulation of the argument ID leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

AnalysisAI

Stack-based buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows authenticated remote attackers with high privileges to execute arbitrary code via malformed ID parameter to yyxz.asp administrative interface. Public exploit code exists on GitHub, demonstrating reliable exploitation. CVSS 7.3 (High) reflects network attack vector but requires admin-level authentication, limiting real-world exposure to compromised credentials or insider scenarios.

Technical ContextAI

The vulnerability resides in yyxz.asp, an administrative web interface component of D-Link DI-8100 enterprise router firmware. The unsafe sprintf() function performs unbounded string copying of user-controlled ID parameter data into a fixed-size stack buffer without length validation. This is a classic CWE-121 stack-based buffer overflow pattern common in legacy C/C++ embedded device firmware. When input exceeds buffer capacity, adjacent stack memory-including return addresses and frame pointers-is overwritten, enabling control-flow hijacking. The DI-8100 is an enterprise-grade multi-WAN load-balancing router; exploitation requires access to the web management interface typically restricted to internal networks or VPN-connected administrators.

RemediationAI

Check D-Link support portal (https://www.dlink.com/) and product-specific firmware pages for security updates addressing CVE-2026-7851; as of analysis time, no vendor advisory or patched firmware version is confirmed in provided references. If no patch is available and device remains in production, implement defense-in-depth: (1) Restrict administrative interface access to trusted management VLANs only-block WAN access entirely and prohibit internet exposure; (2) Enforce strong authentication with complex passwords rotated quarterly and enable multi-factor authentication if supported; (3) Monitor admin access logs for unusual login patterns or access to yyxz.asp endpoint; (4) If feasible, consider hardware replacement with actively supported models as DI-8100 may be end-of-life. Trade-off: Network-level access restrictions do not prevent exploitation by compromised admin accounts but significantly reduce attack surface from external threats.