The vulnerability is a stack‑based buffer overflow triggered by the sprintf function in the yyxz.asp page of D‑Link DI‑8100 routers. By manipulating the ID argument, an attacker can overflow the stack and overwrite control data. This type of flaw can lead to arbitrary code execution, allowing the attacker to run malicious commands on the device. The flaw is pronounced enough that its exploitation can compromise confidentiality, integrity, and availability of the router and the network it protects.

D‑Link DI‑8100 routers running firmware version 16.07.26A1. No other vendors or product lines are listed as affected.

The CVSS score of 8.6 classifies this issue as High severity, and there is no EPSS data available. Because the exploit is publicly documented and can be deployed remotely, the risk to devices with exposed administration interfaces is significant. No formal CISA KEV listing exists, but the existence of a public exploit means the vulnerability is likely being actively scanned by attackers. Often, such buffer overflow vulnerabilities do not require authentication and can be reached from any IP that can access the router’s web interface.