The D‑Link DI‑8100 router is affected by a buffer overflow in the tgfile_htm CGI endpoint; the fn parameter can overflow a fixed‑size buffer, potentially corrupting adjacent memory and allowing an attacker to execute arbitrary code on the device. The flaw is triggered remotely by sending specially crafted HTTP requests to the CGI endpoint, which can lead to a complete compromise of the router if successfully exploited.

The vulnerability exists only in the D‑Link DI‑8100 router running firmware 16.07.26A1; no other firmware versions or D‑Link product families are listed as affected.

The CVSS score of 9.3 indicates critical severity, and publicly available exploit code demonstrates feasibility of exploitation. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog; the remote nature of the attack increases the population of exposed devices that could be targeted.