CVE-2026-7854

D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow

View on CVE.org
Published May 5, 2026 CVSS 4.0 · 9.3 Critical EPSS 5.9% KEV · Not listed
Description
A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Analysis

AI-generated

Technical impact

A buffer overflow occurs in the url_rule.asp POST Parameter Handler of D‑Link DI‑8100 firmware 16.07.26A1 when a malicious user sends an oversized payload to the /url_rule.asp endpoint. The flaw is a classic unbounded memory write (CWE‑119, CWE‑120) and can allow arbitrary code execution on the device. The vendor description states that the vulnerability is exploitable remotely and the exploit has been publicly disclosed, implying that attackers could trigger it from outside the local network.

Affected Systems

The affected system is the D‑Link DI‑8100 router running firmware version 16.07.26A1. No other versions or models are listed in the CNA data.

Risk and Exploitability

The CVSS score of 9.3 denotes a critical severity, and the EPSS score of 6% indicates a moderate exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, but the public disclosure and remote-attack nature suggest that it may be actively exploited. An attacker who can reach the router’s web interface can send a crafted POST request to /url_rule.asp, causing the buffer overflow and potentially gaining full control of the device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the DI‑8100 firmware to the latest version that addresses the buffer overflow flaw
  • If an update is not available, block or drop HTTP POST requests to /url_rule.asp or disable the URL rule feature via the router’s configuration
  • Restrict access to the router’s administrative interface to trusted IPs and enforce strong authentication to limit the attack surface

Generated by OpenCVE AI on October 25, 2026 at 19:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Dlink
Dlink di-8100
Dlink di-8100 Firmware
CPEs cpe:2.3:h:dlink:di-8100:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:di-8100_firmware:16.07.26a1:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink di-8100
Dlink di-8100 Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared D-link
D-link di-8100
Vendors & Products D-link
D-link di-8100
Type Values Removed Values Added
Description A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Title D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 6, 2026, 2:20 PM
Reserved
May 5, 2026, 11:39 AM

View source JSON

Updated
May 6, 2026, 2:20 PM

JSON

Status
Analyzed
Published
May 5, 2026, 7:16 PM
Modified
Jul 24, 2026, 8:10 AM

View source JSON

No data.

Updated
Oct 25, 2026, 8:00 PM

JSON