A buffer overflow occurs in the sprintf function used by the CGI handler for the user_group.asp page on D‑Link DI‑8100 routers. The flaw is a classic CWE‑119/CWE‑120 error that allows an attacker to overflow the stack and overwrite memory. Because the CGI handler handles requests over HTTP, the attack can be launched from any remote host. Successful exploitation can lead to arbitrary code execution with the privileges of the web server process, effectively compromising the entire device.

The vulnerability was identified in the D‑Link DI‑8100 router running firmware 16.07.26A1. Only this specific model and version were confirmed to be affected; other firmware releases are not known to contain the flaw at the time of this report.

The CVSS score of 8.6 indicates a high severity with a high exploitation impact. EPSS information is not available, so the exact likelihood of exploitation is unknown, but the flaw is publicly disclosed and can be used remotely. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to send a specially crafted HTTP request to the user_group.asp CGI endpoint, triggering a stack buffer overflow that may provide remote code execution.