## Summary
D-Link DI-8100 firmware 16.07.26a1 contains a stack-based buffer overflow in the web management interface endpoint /url_member.asp. An attacker can trigger memory corruption by manipulating the name argument during an add operation, potentially leading to process crash and remote code execution.
## Technical Details
- Vulnerability class: stack-based buffer overflow (CWE-121; referenced as CWE-119 in NVD)
- Affected component: Web Management Interface handler /url_member.asp
- Trigger: sending an overly long value in the name parameter (during opt=add)
- Preconditions: authenticated attacker (PoC uses a prior login step)
- Likely outcomes: memory corruption, process crash, and potential remote code execution (per reference)
- Attack vector: remote over the network (per NVD)
PoC methodology (high level):
- Authenticate to the router via login.cgi (using user/password)
- Submit a POST request to /url_member.asp with opt=add and a crafted name value consisting of thousands of A characters
## Affected
- D-Link DI-8100 firmware 16.07.26a1
- Endpoint: /url_member.asp
## Impact
- Potential remote code execution (as stated in the reference)
- Denial of service via process crash
- High confidentiality/integrity/availability risk consistent with CVSS 7.2 (C:H/I:H/A:H)
## Mitigation
1. Restrict access to the DI-8100 management interface (network segmentation / allowlisting) to reduce exposure.
2. Ensure only trusted users can authenticate to the web management interface (the reference indicates PR:H).
3. Apply the vendor’s recommended patch/firmware update for DI-8100 once available; the reference confirms the issue exists in 16.07.26a1.
4. Monitor for anomalous POST requests to /url_member.asp with opt=add and unusually large name values.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-119