EUVD-2026-78273
GHSA-gqwf-9wg7-q94q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain or guess router credentials
-
DeliveryAuthenticate to /ddns.asp web endpoint
-
ExploitSubmit crafted POST with oversized parameter (serv/host/user/etc.)
-
InstallOverflow fixed-size stack buffer in ddns_asp()
-
C2Overwrite return address with attacker payload
-
ExecuteExecute arbitrary code as privileged firmware process
-
ImpactFull router compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) network access to the D-Link DI-8400 web management interface on its configured HTTP port; (2) valid authentication credentials sufficient to access DDNS configuration - the CVSS 4.0 vector assigns PR:L, indicating low-privilege authentication is sufficient rather than requiring full admin credentials, though in practice DDNS config on D-Link devices is typically admin-gated; (3) the device must be running firmware 16.07. Exploitation is limited by the authentication requirement - unauthenticated attackers must first obtain or guess credentials. Management interfaces exposed to the WAN materially broaden the attack surface. Devices behind NAT with LAN-only management access limit reachability to network-adjacent attackers. |
| Impact | The CVSS 4.0 score of 8.6 reflects network-reachable exploitation (AV:N), low complexity (AC:L), and low-privilege authentication (PR:L), with high impact across vulnerable and subsequent systems. A public exploit script is confirmed on GitHub (E:P in the CVSS 4.0 supplemental), materially lowering the barrier to exploitation. The CVE is not currently listed in the CISA KEV catalog, and no EPSS score was provided - exploitation has not yet been confirmed in active campaigns. The PR:L designation implies that DDNS configuration requires at least some level of router authentication, which is a meaningful limiting factor versus a fully pre-auth vulnerability. The scope change (SC:H/SI:H/SA:H) in the CVSS 4.0 vector is plausible given that a compromised router affects all devices and traffic routed through it. Real-world risk is elevated for any internet-exposed or LAN-exposed management interface, particularly for SOHO deployments where default credentials are common and the admin interface is often reachable from LAN without additional segmentation. |
| Exploit ScenarioDerived | An attacker with valid credentials (even a low-privilege account) on a DI-8400 router running firmware 16.07 sends an HTTP POST request to /ddns.asp with an oversized value in the 'host' or 'serv' parameter, triggering the stack buffer overflow in ddns_asp(). The stack overwrite redirects control flow to attacker-controlled shellcode or a ROP chain, achieving remote code execution as the privileged firmware process. The publicly available Python exploit script (ddns_asp.py on GitHub) provides a ready-made template that reduces the skill requirement for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overwrite stack memory via oversized input to any of eight parameters - serv, user, host, wild, mx, bmx, cust, or ip - handled by the ddns_asp() function at the /ddns.asp DDNS configuration endpoint. Successful exploitation can yield arbitrary code execution on the device, giving an attacker full control over the router. A public exploit script exists on GitHub (ddns_asp.py), and no vendor-released patch has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis - D-Link has not published a firmware update or security advisory addressing this vulnerability. As an immediate compensating control, restrict access to the router's web management interface to trusted hosts only by disabling remote (WAN-side) management and, on the LAN side, using firewall ACLs or VLAN segmentation to limit which hosts can reach the management port. Disabling DDNS configuration if the feature is not in active use removes the vulnerable code path. Changing default credentials reduces the likelihood of PR:L exploitation by an unauthenticated actor who relies on credential reuse or defaults. Monitor the vendor advisory page at https://www.dlink.com/ for any forthcoming firmware release. If the device is in or approaching end-of-life status, consider hardware replacement with a currently-supported model, as D-Link has historically declined to patch EoL hardware.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The D-Link DI-8400 is a residential/SOHO routing device; the affected component is the DDNS (Dynamic DNS) configuration handler implemented as a CGI-style ASP endpoint (/ddns.asp). The vulnerability class is CWE-121 (Stack-Based Buffer Overflow): the ddns_asp() function copies user-supplied POST/GET arguments into fixed-size stack buffers without adequate length validation. At least eight distinct parameter names are confirmed attack surfaces (serv, user, host, wild, mx, bmx, cust, ip). The CPE cpe:2.3:a:d-link:di-8400:*:*:*:*:*:*:*:* covers all sub-versions of DI-8400; the specific confirmed firmware is 16.07 per EUVD-2026-78273. Router firmware typically runs as root or an equivalent privileged process, so a successful overflow translating to code execution would provide full device compromise.
Know when Di 8400 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable web interface requires low-privilege authentication; scope change applies as router compromise affects all downstream network traffic.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Technical POC Analysis
Evidence caveat up front: the supplied file is labelled PATCHED SOURCE ddnsasp/ddnsasp.py, but its contents are the public Python exploit (ddnsasp.py), not a patch.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
D-Link DI-8400 routers running firmware 16.07 contain a critical stack buffer overflow in the DDNS configuration interface that allows authenticated administrators to execute arbitrary code and gain complete control over the network perimeter device. Organizations using this router model face significant risk of network compromise and operational disruption if administrative credentials are compromised or misused.
No vendor-released patch identified at time of analysis. Interim mitigation: disable DDNS services if operationally feasible, enforce strong administrator credentials with multi-factor authentication on all network access points, restrict administrative access to isolated jump-host networks only, implement network-based firewall rules isolating affected routers from critical infrastructure, maintain comprehensive access and configuration audit logging, and prioritize device replacement within 90 days pending vendor security update confirmation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows a high-privileged, authenticated remote
Stack-based buffer overflow in D-Link DI-8400 routers through firmware 16.07.26A1 allows authenticated remote attackers
Exploit-DB