CVE-2026-7854
Published: 05 May 2026
Summary
CVE-2026-7854 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Dlink Di-8100 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the buffer overflow by applying firmware patches or updates to fix the vulnerable url_rule_asp function.
Information input validation enforces bounds checking on POST parameters to prevent the buffer overflow trigger in the POST Parameter Handler.
Memory protection mechanisms like DEP and ASLR mitigate arbitrary code execution from the buffer overflow exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in unauthenticated web POST handler (url_rule_asp) on public-facing router firmware directly enables remote code execution via exploitation of an Internet-facing application.
NVD Description
A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the…
more
attack remotely. The exploit has been disclosed publicly and may be used.
Deeper analysisAI
CVE-2026-7854 is a buffer overflow vulnerability in the D-Link DI-8100 router running firmware version 16.07.26A1. The flaw affects the url_rule_asp function in the /url_rule.asp file, which is part of the POST Parameter Handler component. Manipulation of POST parameters triggers the buffer overflow, classified under CWE-119 and CWE-120.
The vulnerability enables remote exploitation by unauthenticated attackers with low attack complexity and no user interaction required, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful attacks can compromise confidentiality, integrity, and availability to a high degree, potentially leading to arbitrary code execution on the device.
Advisories detail the issue in a GitHub report at https://github.com/draw-ctf/report/blob/main/DI-8100/url_rule_asp_overflow.md and VulDB entries at https://vuldb.com/vuln/361131 and related pages. The exploit has been publicly disclosed. Security practitioners should review the D-Link website at https://www.dlink.com/ for firmware updates or mitigation recommendations.
Details
- CWE(s)