Vulnerability · Published May 5, 2026 · Assigned by VulDB
CVE-2026-7854D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow
Critical 9.8
In plain English
A critical-severity buffer overflow in DI-8100 from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.9% (higher than 93% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)5.9%top 6.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Affected products (as reported)
Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-361131 | D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow vdb-entry, technical-description
- VDB-361131 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #807838 | D-Link DI-8100 16.07.26A1 Denial of Service third-party-advisory
- https://github.com/draw-ctf/report/blob/main/DI-8100/url_rule_asp_overflow.md exploit
- https://www.dlink.com/ product