CVE-2026-91001
Received Received - Intake

Stack-Based Buffer Overflow in D-Link DI-8400 Router

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91001
EUVD
EUVD-2026-78273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
d-link di-8400 16.07

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow vulnerability in D-Link DI-8400 16.07 affecting the ddns_asp function in /ddns.asp. It allows remote attackers to manipulate arguments like serv/user/host/wild/mx/bmx/cust/ip to trigger an overflow, potentially enabling arbitrary code execution.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusually long HTTP POST requests targeting the /ddns.asp endpoint. Check for excessive parameter lengths in serv/user/host/wild/mx/bmx/cust/ip fields. Use tools like Wireshark to inspect traffic for malformed requests or crashes. Test with a 1500-byte payload in the serv parameter to trigger potential crashes.

Impact Analysis

An attacker could exploit this to crash the device, execute malicious code, or gain unauthorized access. Since the exploit is public, unpatched systems are at immediate risk of remote attacks leading to data breaches or device compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for sensitive health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the D-Link DI-8400 firmware to the latest version. Disable remote access to the DDNS configuration interface if not required. Block external HTTP POST requests to /ddns.asp at the network firewall. Monitor logs for suspicious activity targeting the vulnerable parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91001. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart