CVE-2026-7855
Buffer Overflow in D-Link DI-8100 Router Firmware
Publication date: 2026-05-05
Last updated on: 2026-05-06
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dlink | di-8100_firmware | 16.07.26a1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the D-Link DI-8100 router firmware version 16.07.26A1, specifically in the tggl_asp function that handles HTTP requests to /tggl.asp.
The issue is a stack-based buffer overflow triggered when an attacker sends an overly long 'name' parameter during an opt=add action.
Unsafe functions like sprintf and strcat are used on a fixed 10240-byte stack buffer without proper bounds checking, allowing attackers to overwrite adjacent memory.
This flaw can be exploited remotely by an authenticated attacker to cause denial-of-service by crashing the httpd service or potentially execute arbitrary code on the router's MIPS-based system.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to several serious impacts:
- Denial-of-service (DoS) by crashing the router's HTTP service, causing service disruption.
- Device reboot or instability due to memory corruption.
- Potential full compromise of the router's web management interface, allowing attackers to execute arbitrary code.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the /tggl.asp endpoint on the D-Link DI-8100 router firmware version 16.07.26A1.
Specifically, detection involves identifying unusually long or malformed 'name' parameters in HTTP requests with the action 'opt=add', which trigger the buffer overflow.
Commands or methods to detect this might include capturing and analyzing HTTP traffic to the router using tools like tcpdump or Wireshark, filtering for requests to /tggl.asp with suspiciously long 'name' parameters.
- Use tcpdump to capture HTTP traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip dst <router_ip>) and (tcp[32:4] = 0x2f746767)))'
- Analyze captured traffic for requests containing 'opt=add' and long 'name' parameters.
- Alternatively, use web application firewall (WAF) or intrusion detection system (IDS) rules to detect and alert on such malformed requests.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the router's web management interface to trusted networks or IP addresses to prevent remote exploitation.
Additionally, monitoring and blocking HTTP requests to /tggl.asp with suspiciously long 'name' parameters can help prevent exploitation.
If possible, disable or limit the use of the vulnerable functionality until a firmware update or patch is available.
Since the exploit is public and can cause denial-of-service or remote code execution, applying any available firmware updates from the vendor should be prioritized once released.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.