Which versions of D-Link DI-8100 are affected by CVE-2026-7857?

CVE-2026-7857 is a buffer overflow in D-Link DI-8100 router firmware (version 16.07.26A1) that allows authenticated administrators to execute arbitrary code and fully compromise the device.

Is there a public PoC exploit available for CVE-2026-7857?

Yes, a public proof-of-concept exploit is available for CVE-2026-7857. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-7857?

Within 24 hours: Inventory all D-Link DI-8100 devices running firmware 16.07.26A1 and document their network locations and administrative access controls. Within 7 days: Implement network segmentation to isolate affected routers from critical systems; restrict administrator account access via principle of least privilege and enforce MFA on remaining administrative accounts. Within 30 days: Contact D-Link support to confirm patch availability timeline; evaluate replacement with routers from vendors providing active security support, or disable the affected /user_group.asp handler if technically feasible.

D-Link DI-8100 CVE-2026-7857

Q: What is the CVSS score of CVE-2026-7857?

CVE-2026-7857 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27488 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-05 VulDB

GHSA-v647-rh6c-m9fr

D-Link Buffer Overflow

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 05, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 20:22 NVD

7.2 (HIGH) 7.3 (HIGH)

Analysis Generated

May 05, 2026 - 20:00 vuln.today

DescriptionCVE.org

A vulnerability has been found in D-Link DI-8100 16.07.26A1. This vulnerability affects the function sprintf of the file /user_group.asp of the component CGI Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Buffer overflow in D-Link DI-8100 router firmware 16.07.26A1 enables authenticated remote code execution via crafted input to the /user_group.asp CGI handler. Attackers with high-privilege (administrator) credentials can exploit the unsafe sprintf function to achieve arbitrary code execution with complete system compromise. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation despite the high-privilege requirement.

Technical ContextAI

This is a classic buffer overflow (CWE-120) in the CGI handler of D-Link DI-8100 router firmware. The vulnerability resides in the /user_group.asp endpoint where the sprintf function is used without proper bounds checking. The sprintf C function copies formatted data into a fixed-size buffer without length validation, allowing attackers to overflow the destination buffer by providing input exceeding its capacity. CGI (Common Gateway Interface) handlers in embedded devices like routers often use legacy C code with unsafe string manipulation functions, making them prone to memory corruption vulnerabilities. The affected product CPE (cpe:2.3:a:d-link:di-8100:*:*:*:*:*:*:*:*) indicates this is a D-Link networking appliance, likely an enterprise-grade router or gateway given the DI-8100 model designation.

RemediationAI

Organizations should immediately check D-Link's official support portal (https://www.dlink.com/) for firmware updates addressing CVE-2026-7857 for the DI-8100 model. No vendor-released patch version is confirmed in the available data at time of analysis. If D-Link has issued a patched firmware, upgrade immediately following vendor procedures. If no patch exists or the device is end-of-life, implement defense-in-depth compensating controls: (1) Restrict administrative interface access to trusted management networks only via firewall rules - block Internet-facing admin access entirely. (2) Enforce strong credential policies: disable default accounts, require complex passwords, implement multi-factor authentication if supported by firmware. (3) Monitor authentication logs for brute-force attempts or anomalous admin sessions. (4) Deploy intrusion detection signatures for exploitation attempts targeting /user_group.asp with oversized parameters. (5) Consider replacing vulnerable devices with supported alternatives if D-Link confirms end-of-support status. Trade-off: Restricting admin access may complicate remote management but is essential given the authentication-dependent exploit path. VulDB reference (https://vuldb.com/vuln/361134) and exploit details (https://github.com/draw-ctf/report/blob/main/DI-8100/user_group_asp_overflow.md) provide technical indicators for defensive measures.