Cyber Posture

CVE-2026-7855

High

Published: 05 May 2026

Published
05 May 2026
Modified
05 May 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 5.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the component HTTP Request Handler. Performing a manipulation of the argument Name results in buffer overflow. The attack can…

more

be initiated remotely. The exploit is now public and may be used.

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-119 CWE-120

Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.

addresses: CWE-119

Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.

addresses: CWE-119

Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.

addresses: CWE-119

Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.

Security SummaryAI

CVE-2026-7855 is a buffer overflow vulnerability affecting the D-Link DI-8100 router running firmware version 16.07.26A1. The issue resides in the tggl_asp function within the /tggl.asp file of the HTTP Request Handler component. It is triggered by manipulating the "Name" argument in an HTTP request, leading to a buffer overflow classified under CWE-119 and CWE-120. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-05-05.

Attackers with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise on the affected device.

References include a GitHub report detailing the overflow in /tggl.asp, VulDB entries (including submission and CTI data), and the D-Link website. The exploit is publicly available and may be used, but no specific patch or mitigation details are outlined in the provided information.

The public availability of the exploit increases the risk for unpatched D-Link DI-8100 devices exposed to the internet.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Buffer overflow in public-facing HTTP handler (/tggl.asp) on network device allows remote authenticated RCE with low privileges and high C/I/A impact, directly mapping to exploitation of public-facing apps (T1190) and privilege escalation via vuln (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References