CVE-2026-7855

HighCVSS 7.2/10Last modified Jul 24, 2026

Description

A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the component HTTP Request Handler. Performing a manipulation of the argument Name results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
D-Link	DI-8100	16.07.26A1

References

https://github.com/draw-ctf/report/blob/main/DI-8100/tggl_asp_overflow.mdExploit, Third Party Advisory
https://vuldb.com/submit/807841Third Party Advisory, VDB Entry
https://vuldb.com/vuln/361132Third Party Advisory, VDB Entry
https://vuldb.com/vuln/361132/ctiPermissions Required, VDB Entry
https://www.dlink.com/Product

Timeline

Published: May 5, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-785507.2The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator S CVE-2026-785518.8RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid user CVE-2026-785524.9The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is inter CVE-2026-785537.0RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secret_key file was created using CVE-2026-785559.4RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface disp CVE-2026-785567.4A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly valid CVE-2026-785578.3A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or CVE-2026-78567.2A flaw has been found in D-Link DI-8100 16.07.26A1. This affects an unknown part of the file /url_member.asp of the component Web Management CVE-2026-785606.5The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP heade CVE-2026-785698.8IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the s CVE-2026-78577.2A vulnerability has been found in D-Link DI-8100 16.07.26A1. This vulnerability affects the function sprintf of the file /user_group.asp of CVE-2026-785718.8IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call