Which versions of D-Link DI-8100 are affected by CVE-2026-7854?

CVE-2026-7854 is a critical remote code execution vulnerability affecting D-Link DI-8100 network appliances (firmware 16.07.26A1) that allows unauthenticated attackers to execute arbitrary code and…

Is there a public PoC exploit available for CVE-2026-7854?

Yes, a public proof-of-concept exploit is available for CVE-2026-7854. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-7854?

Within 24 hours: Inventory all D-Link DI-8100 devices and verify firmware version (16.07.26A1 and prior versions). Restrict network access to the device's web interface (/url_rule.asp) using firewall rules or network segmentation-allow only trusted administrative IPs. Within 7 days: Check D-Link security advisories for patch availability; if released, schedule immediate firmware updates across all affected devices in a controlled testing environment first. Within 30 days: If no patch is released, evaluate replacement with alternative equipment from vendors with active security support, or implement air-gapped network isolation as a permanent mitigation.

D-Link DI-8100 CVE-2026-7854

Q: What is the CVSS score of CVE-2026-7854?

CVE-2026-7854 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27430 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-05 VulDB

GHSA-5w9m-8h62-42jw

D-Link Buffer Overflow

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 05, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

May 05, 2026 - 19:22 NVD

CRITICAL HIGH

CVSS changed

May 05, 2026 - 19:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

Analysis Generated

May 05, 2026 - 19:01 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Remote unauthenticated buffer overflow in D-Link DI-8100 firmware 16.07.26A1 enables attackers to execute arbitrary code, compromise device integrity, and cause denial of service via crafted POST requests to /url_rule.asp. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation. The CVSS 9.8 critical score reflects network-based remote attack requiring no authentication or user interaction, though no active exploitation has been confirmed via CISA KEV at time of analysis.

Technical ContextAI

This is a classic stack-based or heap-based buffer overflow (CWE-120) in the url_rule_asp function handling POST parameters submitted to /url_rule.asp on the D-Link DI-8100 router firmware version 16.07.26A1. Buffer overflows occur when input data exceeds allocated memory boundaries without proper bounds checking, allowing attackers to overwrite adjacent memory regions including return addresses, function pointers, or critical data structures. In embedded devices like routers, these vulnerabilities typically exist in web management interfaces written in C/C++ without modern memory protection mechanisms. The affected component is part of the device's administrative web interface, which processes URL filtering rules. The CPE identifier cpe:2.3:a:d-link:di-8100 indicates this is application-level firmware vulnerability in D-Link's enterprise multi-WAN VPN router product line.

RemediationAI

D-Link has not released a security advisory or confirmed patched firmware version at time of analysis - check https://www.dlink.com/ and D-Link support channels for updated firmware releases addressing CVE-2026-7854. Until a vendor patch is available, implement the following compensating controls: (1) Restrict administrative web interface access to trusted management networks only by configuring firewall rules blocking external access to ports 80/443 on the DI-8100 - this prevents remote exploitation but does not protect against insider threats or compromised internal networks. (2) Deploy the DI-8100 behind a dedicated firewall or jump host requiring multi-factor authentication for administrative access - adds authentication barrier but increases management complexity. (3) Monitor device logs and network traffic to /url_rule.asp for unusual POST requests with oversized parameters - detection-only measure requiring active security monitoring. (4) If operational requirements permit, consider replacing affected devices with alternative router models not vulnerable to this flaw - highest security assurance but incurs hardware replacement costs and service interruption. Organizations unable to implement network-level access controls should consider the device compromised if exposed to untrusted networks.