Which versions of D-Link DI-8100 are affected by CVE-2026-7855?

CVE-2026-7855 is a buffer overflow vulnerability in D-Link DI-8100 routers (firmware 16.07.26A1) that allows authenticated attackers to execute arbitrary code or crash the device through malicious…

Is there a public PoC exploit available for CVE-2026-7855?

Yes, a public proof-of-concept exploit is available for CVE-2026-7855. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7855?

Within 24 hours: Identify all D-Link DI-8100 routers in the environment and their current firmware versions; isolate or restrict administrative access to affected devices pending remediation. Within 7 days: Contact D-Link support to confirm patch availability timeline for firmware 16.07.26A1; implement network access controls limiting HTTP access to the /tggl.asp endpoint to trusted administrative networks only. Within 30 days: Apply vendor-released firmware update once available; if no patch is released, evaluate replacement or decommissioning of affected routers; conduct audit of router credential management and reset all default credentials.

D-Link DI-8100 CVE-2026-7855

Q: What is the CVSS score of CVE-2026-7855?

CVE-2026-7855 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27432 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-05 VulDB

GHSA-6jv6-c544-6g2q

D-Link Buffer Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 19:30 vuln.today

CVSS changed

May 05, 2026 - 19:22 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the component HTTP Request Handler. Performing a manipulation of the argument Name results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

Buffer overflow in D-Link DI-8100 router (firmware 16.07.26A1) allows authenticated remote attackers to execute arbitrary code or crash the device via crafted HTTP requests to the /tggl.asp endpoint. The vulnerability affects the tggl_asp function's Name parameter handling. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation for attackers with valid router credentials.

Technical ContextAI

The vulnerability resides in the D-Link DI-8100's HTTP request handler, specifically in the tggl_asp function within /tggl.asp. This is a classic stack-based or heap-based buffer overflow (CWE-120) where improper bounds checking on the Name parameter allows attackers to write data beyond allocated memory boundaries. The DI-8100 is a multi-WAN load balancing router commonly deployed in small-to-medium business environments. The affected firmware version 16.07.26A1 uses vulnerable input validation routines in its embedded web server. When processing HTTP requests to tggl.asp, the function copies user-supplied Name parameter data without adequate length validation, enabling memory corruption. The CPE identifier cpe:2.3:a:d-link:di-8100:*:*:*:*:*:*:*:* confirms this is an application-layer vulnerability in D-Link's proprietary firmware codebase.

RemediationAI

No vendor-released security patch is identified in the available references at time of analysis. Organizations operating D-Link DI-8100 devices should immediately contact D-Link technical support to request firmware update availability and security guidance. Until an official patch is released, implement defense-in-depth controls: restrict administrative interface access to trusted management networks only using firewall rules or access control lists (eliminates remote attack vector but impacts remote administration capabilities); enforce strong, unique administrative passwords and disable default credentials (raises authentication barrier); deploy network segmentation to isolate the router's management plane from general user networks (limits credential exposure); enable administrative access logging and monitor for suspicious /tggl.asp requests with abnormal Name parameter lengths (provides detection capability but won't prevent exploitation). Consider replacing the DI-8100 with alternative load balancing solutions if D-Link cannot provide timely security updates, as the device may have reached end-of-life status given the older firmware version numbering. Consult VulDB entry https://vuldb.com/vuln/361132 and the GitHub exploit repository https://github.com/draw-ctf/report/blob/main/DI-8100/tggl_asp_overflow.md for technical details to inform detection rules.