Which versions of D-Link DI-8100 are affected by CVE-2026-7853?

CVE-2026-7853 is a critical remote code execution vulnerability affecting D-Link DI-8100 routers running firmware 16.07.26A1, enabling unauthenticated attackers to compromise devices through HTTP…

Is there a public PoC exploit available for CVE-2026-7853?

Yes, a public proof-of-concept exploit is available for CVE-2026-7853. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-7853?

Within 24 hours: Identify all D-Link DI-8100 devices on the network and document firmware versions via administrative access or network scanning; isolate any devices running firmware 16.07.26A1 from production networks if possible. Within 7 days: Contact D-Link support to determine if a patched firmware version exists beyond 16.07.26A1, and test any available firmware updates in a controlled environment; implement network segmentation to restrict HTTP access to the /auto_reboot.asp endpoint via firewall rules. Within 30 days: Deploy patched firmware to all affected devices once vendor confirms availability and stability, or evaluate router replacement if no patch is forthcoming.

D-Link DI-8100 CVE-2026-7853

Q: What is the CVSS score of CVE-2026-7853?

CVE-2026-7853 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27418 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-05 VulDB

GHSA-mrhg-43m6-jq5j

Buffer Overflow D-Link Di 8100 D-Link

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 18:30 vuln.today

Severity Changed

May 05, 2026 - 18:22 NVD

CRITICAL HIGH

CVSS changed

May 05, 2026 - 18:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

DescriptionCVE.org

A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This manipulation of the argument enable/time causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 allows remote unauthenticated attackers to execute arbitrary code via crafted HTTP requests to /auto_reboot.asp. The vulnerability exploits unsafe sprintf calls handling the 'enable' and 'time' parameters in the auto-reboot feature's HTTP handler. A public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation. CVSS 8.9 with EPSS and attack complexity both low indicate high real-world risk for internet-facing devices running this firmware version.

Technical ContextAI

The vulnerability resides in the HTTP request handler for /auto_reboot.asp, specifically in the sprintf function implementation within the D-Link DI-8100's web management interface. CWE-120 (Buffer Copy without Checking Size of Input) indicates classic unsafe string handling where user-supplied parameters 'enable' and 'time' are copied into a fixed-size buffer without bounds checking. The sprintf C function writes formatted output to a buffer but does not verify destination buffer capacity, allowing input exceeding buffer size to overwrite adjacent memory regions including return addresses, function pointers, or other critical data structures. This is a stack-based buffer overflow given the typical usage pattern of sprintf with automatic storage duration buffers in embedded device firmware. The D-Link DI-8100 is a multi-WAN VPN router running embedded Linux with a proprietary web administration interface, making memory corruption vulnerabilities particularly impactful as the HTTP handler likely runs with elevated privileges necessary for system configuration changes.

RemediationAI

Contact D-Link support immediately to confirm availability of patched firmware newer than 16.07.26A1, as no specific fix version is identified in current vulnerability disclosures or vendor advisories (https://www.dlink.com/). Until a verified patch is deployed, implement network-layer compensating controls: restrict access to the web management interface (typically TCP ports 80/443) to trusted administrative networks only via firewall rules or access control lists, ensuring the management interface is NOT reachable from WAN/internet interfaces. If remote administration is required, enforce access exclusively through VPN with multi-factor authentication. Consider disabling the auto-reboot feature entirely if operationally feasible, though this may not fully mitigate risk if the unsafe sprintf pattern exists in other HTTP handlers. Monitor for HTTP requests to /auto_reboot.asp with unusually long 'enable' or 'time' parameter values (>256 bytes) as potential exploitation attempts. WARNING: Disabling WAN management access may complicate remote troubleshooting; evaluate this trade-off against exploitation risk for your deployment. Given the device's end-of-life status (firmware dated 2016-2017), consider hardware replacement with currently supported models if vendor confirms no patch will be released.