CVE-2026-7854

CriticalCVSS 9.8/10Last modified Jul 24, 2026

Description

A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
D-Link	DI-8100	16.07.26A1

References

https://github.com/draw-ctf/report/blob/main/DI-8100/url_rule_asp_overflow.mdExploit, Third Party Advisory
https://vuldb.com/submit/807838Third Party Advisory, VDB Entry
https://vuldb.com/vuln/361131Third Party Advisory
https://vuldb.com/vuln/361131/ctiPermissions Required, VDB Entry
https://www.dlink.com/Product

Timeline

Published: May 5, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-785418.5A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attac CVE-2026-785437.5IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1 CVE-2026-785457.2The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The uns CVE-2026-785464.8Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current CVE-2026-785474.4Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2 CVE-2026-78557.2A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the comp CVE-2026-785507.2The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator S CVE-2026-785518.8RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid user CVE-2026-785524.9The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is inter CVE-2026-785537.0RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using CVE-2026-785559.4RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface disp CVE-2026-785567.4A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly valid