A buffer overflow occurs in the url_rule.asp POST Parameter Handler of D‑Link DI‑8100 firmware 16.07.26A1 when a malicious user sends an oversized payload to the /url_rule.asp endpoint. The flaw is a classic unbounded memory write (CWE‑119, CWE‑120) and can allow arbitrary code execution on the device. The vendor description states that the vulnerability is exploitable remotely and the exploit has been publicly disclosed, implying that attackers could trigger it from outside the local network.

The affected system is the D‑Link DI‑8100 router running firmware version 16.07.26A1. No other versions or models are listed in the CNA data.

The CVSS score of 9.3 denotes a critical severity, and the lack of an EPSS score means the exploitation likelihood cannot be quantified from public data. The vulnerability is not listed in CISA’s KEV catalog, but the public disclosure and remote-attack nature suggest that it may be actively exploited. An attacker who can reach the router’s web interface can send a crafted POST request to /url_rule.asp, causing the buffer overflow and potentially gaining full control of the device.