CVE-2026-7854

8.9 highEPSS 5.9%

High (8.9) in dlink di-8100 firmware. EPSS 5.9% chance of exploitation in the next 30 days.

A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Severity

CVSS 4.0

8.9 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.9% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWEs: CWE-119, CWE-120
Published: 2026-05-05
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

Affected

dlink:di-8100_firmware

References

https://github.com/draw-ctf/report/blob/main/DI-8100/url_rule_asp_overflow.md
https://vuldb.com/submit/807838
https://vuldb.com/vuln/361131
https://vuldb.com/vuln/361131/cti
https://www.dlink.com/

Check your stack JSON