# CVE-2026-7857: D-Link DI-8100 buffer overflow in user_group.asp CGI handler

Source: https://junglewise.ai/threats/cve-2026-7857-d-link-di-8100-buffer-overflow-in-user-group-asp-cgi-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-7857 · Severity: high · CVSS 7.2 · Published 2026-05-05

A security vulnerability exists in the D-Link DI-8100 enterprise router. An attacker with administrative access can send a specially crafted request to the device's management interface to cause a system crash or potentially take full control of the hardware. This could lead to a total disruption of network services or unauthorized access to internal traffic.

Technologies: [Dlink Di-8100](https://junglewise.ai/threats/technologies/di-8100), [Dlink Di-8100 Firmware](https://junglewise.ai/threats/technologies/di-8100-firmware). Vendors: [Dlink](https://junglewise.ai/threats/vendors/dlink).

## Quick answers

**Is CVE-2026-7857 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7857 being exploited in the wild.

**How severe is CVE-2026-7857?** High severity, with a CVSS score of 7.2, published 5 May 2026.

**Which products and versions are affected?** D-Link DI-8100 16.07.26A1.

**Is there a fix for CVE-2026-7857?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7857 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-7857?** Check whether you run Dlink Di-8100 or Dlink Di-8100 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow vulnerability exists in the CGI handler of D-Link DI-8100 firmware version 16.07.26A1. The flaw is located in the processing of the /user_group.asp endpoint, specifically within a function that utilizes the unsafe 'sprintf' function to concatenate user-supplied parameters (such as 'attr', 'name', 'mem', and 'pri') into a fixed-size stack buffer without bounds checking. An authenticated attacker can exploit this by sending a crafted HTTP POST request with an oversized string, leading to stack corruption. This can result in a crash of the HTTP service (DoS) or potentially remote code execution (RCE). A public exploit (PoC) has been disclosed.

## Affected products

- D-Link DI-8100 16.07.26A1

## Timeline

- 2026-05-05: disclosed: Public disclosure of the vulnerability and PoC.
- 2026-05-05: advisory

## References

- [https://github.com/draw-ctf/report/blob/main/DI-8100/user_group_asp_overflow.md](https://github.com/draw-ctf/report/blob/main/DI-8100/user_group_asp_overflow.md)
- [https://vuldb.com/submit/807853](https://vuldb.com/submit/807853)
- [https://vuldb.com/vuln/361134](https://vuldb.com/vuln/361134)
- [https://vuldb.com/vuln/361134/cti](https://vuldb.com/vuln/361134/cti)
- [https://www.dlink.com/](https://www.dlink.com/)

## Related threats

- [D-Link DI-8100 stack buffer overflow in url_member.asp](https://junglewise.ai/threats/cve-2026-7856-d-link-di-8100-stack-buffer-overflow-in-url-member-asp)
- [D-Link DI-8100 buffer overflow in tggl_asp function](https://junglewise.ai/threats/cve-2026-7855-d-link-di-8100-buffer-overflow-in-tggl-asp-function)
- [D-Link DI-8100 buffer overflow in url_rule.asp](https://junglewise.ai/threats/cve-2026-7854-d-link-di-8100-buffer-overflow-in-url-rule-asp)
- [D-Link DI-8100 buffer overflow in /auto_reboot.asp](https://junglewise.ai/threats/cve-2026-7853-d-link-di-8100-buffer-overflow-in-auto-reboot-asp)
- [D-Link DI-8100 stack-based buffer overflow in yyxz.asp](https://junglewise.ai/threats/cve-2026-7851-d-link-di-8100-stack-based-buffer-overflow-in-yyxz-asp)