CVE-2026-7854
Published: 05 May 2026
Description
A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the…
more
attack remotely. The exploit has been disclosed publicly and may be used.
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.
Security SummaryAI
CVE-2026-7854 is a buffer overflow vulnerability in the D-Link DI-8100 router running firmware version 16.07.26A1. The flaw affects the url_rule_asp function in the /url_rule.asp file, which is part of the POST Parameter Handler component. Manipulation of POST parameters triggers the buffer overflow, classified under CWE-119 and CWE-120.
The vulnerability enables remote exploitation by unauthenticated attackers with low attack complexity and no user interaction required, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful attacks can compromise confidentiality, integrity, and availability to a high degree, potentially leading to arbitrary code execution on the device.
Advisories detail the issue in a GitHub report at https://github.com/draw-ctf/report/blob/main/DI-8100/url_rule_asp_overflow.md and VulDB entries at https://vuldb.com/vuln/361131 and related pages. The exploit has been publicly disclosed. Security practitioners should review the D-Link website at https://www.dlink.com/ for firmware updates or mitigation recommendations.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated web POST handler (url_rule_asp) on public-facing router firmware directly enables remote code execution via exploitation of an Internet-facing application.