CVE-2026-10206

Vulnerability

A stack-based buffer overflow vulnerability exists in D-Link DI-8400 routers running firmware versions up to and including 16.07.26A1. The flaw resides in the file /dbsrv.asp, which processes the str POST parameter. When the value of src is not empty, the function calls strcpy without bound checking, leading to a buffer overflow on the stack. The vulnerability was discovered by a researcher who noted the parameter name str, though the advisory initially mentioned contradicting parameter names [2].

Exploitation

An attacker can exploit this vulnerability remotely without any authentication. The attack involves sending a specially crafted HTTP POST request to /dbsrv.asp with an overly long str parameter value that overflows the stack buffer. The public proof-of-concept shows the request with a large string of 'a', 'b', and 'h' characters, overwriting adjacent memory locations. No user interaction is required, and no special network position is needed beyond reachability to the router's web interface [2].

Impact

Successful exploitation can result in a denial of service (DoS) condition or arbitrary command execution on the affected router. The overflow corrupts the stack, allowing an attacker to control return addresses or function pointers, potentially gaining full remote code execution with root privileges on the device. This compromises all three security objectives (confidentiality, integrity, and availability) [2].

Mitigation

As of the publication date (2026-06-01), D-Link has not released a firmware update to address this vulnerability. The affected product, DI-8400 with firmware ≤16.07.26A1, may be end-of-life or no longer supported; users should check the vendor's support page [1]. The only mitigation is to restrict access to the router's management interface to trusted networks only, or replace the device if no fix becomes available. A public exploit exists [2], increasing the urgency for action.