D-Link DI-8100 CVE-2026-7851

Requires valid administrative credentials (PR:H in CVSS vector) to access the D-Link DI-8100 web management interface. The vulnerable yyxz.asp endpoint is part of the authenticated admin panel, not publicly accessible without login. Network connectivity to the management interface is required (AV:N), which may be LAN-only in secure deployments or internet-exposed in misconfigured installations. No user interaction is needed post-authentication (UI:N). Exploitation is limited by credential access-default passwords, weak passwords, or compromised admin accounts are the enabling factor. Organizations restricting management to isolated VLANs with strong authentication significantly reduce practical exploitability despite low attack complexity once authenticated.

Real-world risk is elevated but scope-limited. CVSS 7.3 High severity reflects complete system compromise (VC:H/VI:H/VA:H) via network vector (AV:N) with low complexity (AC:L), but critically requires high-privilege authentication (PR:H)-typically admin credentials. The E:P (Proof-of-concept) metric confirms working exploit code exists on GitHub. However, no EPSS score or CISA KEV data is provided in intelligence sources, suggesting exploitation is not yet widespread despite POC availability. Attack complexity is low once authenticated, but the high privilege requirement significantly constrains attacker population to credential theft scenarios, phishing victims, or malicious insiders. Enterprise defenders should prioritize this for internet-facing management interfaces or environments with weak credential hygiene, but lower priority where admin access is properly restricted to trusted networks with MFA enforced. The device appears to be older enterprise hardware; confirm if still in production use before resource allocation.

An attacker obtains D-Link DI-8100 administrative credentials through phishing, credential stuffing, or default password reuse. They authenticate to the web management interface over the network and craft an HTTP request to yyxz.asp with an oversized ID parameter (e.g., 2000+ byte payload containing shellcode). The sprintf() call overflows the stack buffer, overwriting the return address to redirect execution to attacker-controlled code. The attacker achieves root-level code execution on the router, enabling installation of persistent backdoors, traffic interception, or pivoting to internal network segments.