CVE-2026-7248
Remote Buffer Overflow in D-Link DI-8100 CGI Endpoint
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | di-8100_firmware | 16.07.26a1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the D-Link DI-8100 router firmware, specifically in the tgfile.htm CGI endpoint within the tgfile_htm function. It is caused by unsafe use of the sprintf function with user-supplied input through the "fn" parameter. The function uses a fixed-size stack buffer of 128 bytes and prepends a fixed string before appending the user input without checking its length. If the "fn" parameter exceeds 117 bytes, it causes a stack-based buffer overflow by writing beyond the buffer boundary.
This overflow can corrupt the stack frame and potentially overwrite the saved return address, leading to control-flow hijacking when the function returns. An attacker can exploit this remotely by sending a crafted HTTP request with an overly long "fn" parameter, which can crash the web server process or possibly allow remote code execution.
How can this vulnerability impact me? :
The vulnerability can have several serious impacts:
- Denial of Service (DoS): The web server process crashes when exploited, causing the administrative interface to become unresponsive until the device is rebooted.
- Potential Remote Code Execution (RCE): Due to control-flow hijacking, an attacker might execute arbitrary code remotely, compromising the device.
- Integrity Risk: The attacker can manipulate the device's operation by exploiting the buffer overflow.
- Confidentiality Risk: There is a low risk of stack memory leakage, which might expose sensitive information.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP request to the tgfile.htm CGI endpoint with an overly long "fn" parameter. A proof-of-concept uses a curl command to send a request with a 200-character "fn" parameter, which causes the web server to crash and become unresponsive.
- Use the following curl command to test for the vulnerability: curl "http://<target-ip>/tgfile.htm?fn=$(python3 -c 'print("A"*200)')"
If the web server crashes or the administrative interface becomes unresponsive after this request, the device is likely vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding exposure of the vulnerable CGI endpoint to untrusted networks and restricting access to the device's administrative interface.
If possible, reboot the device after detecting a crash caused by exploitation attempts to restore service temporarily.
Monitor network traffic for suspicious requests targeting the tgfile.htm endpoint with unusually long "fn" parameters.
Since the exploit is public and can cause denial of service or potentially remote code execution, consider isolating the device from critical networks until a firmware update or patch is available.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the D-Link DI-8100 router allows remote attackers to cause a buffer overflow via the tgfile.htm CGI endpoint, potentially leading to remote code execution and denial of service. This can compromise the integrity and availability of the device.
Such impacts on integrity and availability could affect compliance with standards like GDPR and HIPAA, which require protection of data confidentiality, integrity, and availability. Specifically, the potential for remote code execution and service disruption could lead to unauthorized access or loss of sensitive data, violating these regulations.
However, the provided information does not explicitly detail compliance implications or specific regulatory impacts.