Executive brief
A security vulnerability exists in the D-Link DI-8100 enterprise router. An attacker with administrative access can send a specially crafted request to the device's management interface to cause a system crash or potentially take full control of the hardware. This could lead to a total disruption of network services or unauthorized access to internal traffic.
Technical details
A stack-based buffer overflow vulnerability exists in the CGI handler of D-Link DI-8100 firmware version 16.07.26A1. The flaw is located in the processing of the /user_group.asp endpoint, specifically within a function that utilizes the unsafe 'sprintf' function to concatenate user-supplied parameters (such as 'attr', 'name', 'mem', and 'pri') into a fixed-size stack buffer without bounds checking. An authenticated attacker can exploit this by sending a crafted HTTP POST request with an oversized string, leading to stack corruption. This can result in a crash of the HTTP service (DoS) or potentially remote code execution (RCE). A public exploit (PoC) has been disclosed.
Affected products
- D-Link DI-8100 16.07.26A1
Timeline
- 2026-05-05: disclosed: Public disclosure of the vulnerability and PoC.
- 2026-05-05: advisory