CVE-2026-7248: Critical Buffer Overflow in D-Link DI-8100

CVE-2026-7248 is a critical (CVSS 9.8) buffer overflow in the D-Link DI-8100 router, firmware 16.07.26A1, reached through the fn parameter of the tgfile.htm CGI endpoint. The record says an exploit is public. No fixed firmware is named, so restrict access and check D-Link.

What's affected

The record lists the D-Link DI-8100 and its firmware, version 16.07.26A1. The vulnerable function is tgfile_htm in the file tgfile.htm of the CGI endpoint, and the argument is fn.

The researcher's report says the issue may be present in other revisions and that the device may be end of life. I could not confirm either point from a vendor source. No fixed version is given anywhere I could read. Check the D-Link support page for the DI-8100 for advisories or a retirement notice.

How to check if you're exposed

Open the router's admin interface and read the firmware version from the status or system page.

Then check exposure. Make sure the admin interface is not reachable from the internet, and check from outside your network if you can. Limit the pages that answer to trusted internal hosts.

What to do now

1. List all DI-8100 devices and their firmware versions.
2. Turn off remote administration and block the web interface from untrusted networks.
3. Check D-Link's support page for a patched firmware or an end of life notice.
4. If the model is no longer supported, schedule a replacement.
5. Watch the device for unexpected reboots, which the report describes as a likely symptom.

Why it matters

The record lists CWE-119 and CWE-120, the memory buffer family and the classic copy without checking size. The report describes a formatted string write into a fixed stack buffer using text taken from the request. If the text is longer than the buffer, it overwrites neighboring memory.

The report says the most likely result is a crash or reboot of the device, and says code execution cannot be ruled out. That is a cautious statement, not a demonstrated one.

Small office routers often go years without firmware updates, and the web interface is the usual way in. The record says a public exploit exists, and its KEV flag is false.

Quick check

Sources

• Researcher report linked by the record

Last reviewed: 19 October 2026.