CVE-2026-101081 is a critical (CVSS 9.1) stack-based buffer overflow in the web administration service of the D-Link DI-8400, firmware 16.07, in the menu_nat_more.asp page. The record lists no fixed version. Check D-Link's security notices, limit access to the admin interface and plan for replacement if no fix appears.
What's affected
The record names the D-Link DI-8400 running 16.07 and the menu_nat_more_asp function of the Web Administration Service, where the opt argument is the problem input.
The record does not mention a fixed version or a vendor response. Do not assume either way. The D-Link security advisory pages are the place to look.
How to check if you're exposed
There is no package manager entry for this, so check the device itself.
- Search your inventory for the D-Link DI-8400. The record names firmware 16.07.
- Confirm the model and firmware from the label or the admin page.
- Check whether the management interface can be reached from the internet or from untrusted networks, for example with a scan of your own public address space.
What to do now
- Check D-Link's security advisory pages for the DI-8400 and apply any firmware they publish.
- Until then, restrict the web administration interface to one trusted management host and never expose it to the internet.
- Review administrator accounts and change the password, since the vector lists high privileges.
- Segment the device away from sensitive systems.
- If no fix is published and the product is end of life, schedule a replacement.
Why it matters
The weakness is a stack-based buffer overflow, filed as CWE-119 and CWE-121. Input larger than the buffer overwrites neighbouring memory.
The vector requires high privileges, which is the main reason this is 9.1 rather than 10.0. Those privileges will often be an admin login on a shared or default password. The scope is changed, so impact can reach beyond the web service itself.
The record says the exploit has been released publicly. It does not report exploitation in the wild, and KEV is false.
Quick check
Does the high privilege requirement make this safe to ignore?
No. It lowers the odds, but admin credentials are often weak, reused or exposed. Treat it as serious if the admin interface is reachable.
Sources
Last reviewed: 19 October 2026.
