D-Link DI-8100 EUVD-2026-27418

Remote network access to the D-Link DI-8100 web management interface (HTTP/HTTPS ports 80/443) is required, specifically the ability to send HTTP requests to the /auto_reboot.asp endpoint. No authentication is required per the CVSS vector (PR:N), indicating the vulnerability exists in a pre-authentication code path or in functionality accessible without valid credentials. The auto_reboot.asp handler must be present and enabled in the firmware, which appears to be default functionality for system scheduled reboot features in D-Link routers. Exploitation is limited to devices running the specific vulnerable firmware version 16.07.26A1, though similar versions may share the unsafe code pattern. Default D-Link configurations often restrict WAN management access, but many deployments enable remote administration for convenience, and misconfigurations exposing management interfaces to the internet are common in enterprise branch office scenarios. No user interaction required (UI:N) means automated exploitation is feasible once the management interface is network-reachable.

Real-world risk is CRITICAL for internet-exposed devices. CVSS 4.0 vector shows maximum exploitability: network-reachable (AV:N), low complexity (AC:L), no attack requirements (AT:N), no privileges required (PR:N), no user interaction (UI:N), and proof-of-concept code available (E:P). The combination of unauthenticated remote exploitation with publicly available exploit code creates immediate weaponization potential. While EPSS data is not provided, the attack surface characteristics (web management interface on enterprise routers commonly exposed to internet) and POC availability suggest high probability of exploitation attempts. CVSS rates all vulnerable system impacts as high (VC:H/VI:H/VA:H) with no subsequent system impact (SC:N/SI:N/SA:N), indicating the scope is limited to the vulnerable router itself but complete compromise of that device is achievable. The D-Link DI-8100 is an enterprise multi-WAN router often deployed at network perimeters, meaning successful exploitation provides attackers with a strategic foothold for lateral movement, traffic interception, and persistent network access. No CISA KEV listing at time of analysis suggests exploitation is not yet widespread, but the POC publication and typical internet exposure of management interfaces make active exploitation highly probable in the near term. PRIMARY CONCERN: Many D-Link enterprise routers ship with web management accessible from WAN interfaces by default or are misconfigured to allow such access.

An attacker performs internet-wide scanning for D-Link DI-8100 routers with exposed web management interfaces on ports 80 or 443. Upon identifying a target running firmware 16.07.26A1, the attacker crafts an HTTP POST request to /auto_reboot.asp containing oversized 'enable' or 'time' parameter values designed to overflow the sprintf destination buffer. Using the publicly available GitHub POC as a template, the attacker overwrites the stack return address to redirect execution to shellcode embedded in the HTTP request payload or to existing code gadgets via ROP techniques. Successful exploitation grants arbitrary code execution in the context of the web server process, likely running as root or with administrative privileges, enabling the attacker to install persistent backdoors, modify routing tables to intercept traffic, extract VPN credentials, or pivot to internal network segments accessible through the compromised router.