Introduction
An unauthenticated buffer overflow in the D-Link DI-8100 router lets a remote attacker corrupt stack memory and potentially execute arbitrary code without credentials. The flaw scores 9.8 on CVSS and a public exploit is already available. The affected hardware has also reached End of Life, so no firmware patch will ever be released.
The D-Link DI-8100 is an enterprise-class router made by D-Link Corporation, a Taiwanese multinational networking equipment vendor founded in 1986. D-Link sells to both consumer and enterprise markets globally, and it positioned the DI-8100 as a managed router for small and medium business deployments. The product line has been discontinued, but devices remain in active use on networks worldwide.
Technical Information
The vulnerability is in the auto_reboot_asp function in the router's firmware, which handles HTTP requests to the /auto_reboot.asp endpoint. The router's HTTP daemon, jhttpd, processes configuration requests for the automatic reboot feature by extracting two user-supplied parameters: enable and time.
The root cause is a classic unsafe use of sprintf(). The function formats user-controlled input into a fixed-size stack buffer named acStack_90, which is only 104 bytes long. The code performs no bounds checking or input length validation before the copy, so any input longer than 104 bytes writes past the end of the buffer and into adjacent stack memory.
Attack Flow
The exploitation path is straightforward:
-
The attacker identifies a D-Link DI-8100 device exposed to the network. Search engine dorks that target the
auto_reboot.aspURL can locate vulnerable targets. -
The attacker crafts an HTTP POST request to the
/auto_reboot.aspendpoint, supplying overly long values for theenableand/ortimeparameters. -
The
jhttpddaemon receives the request and passes the parameter values directly tosprintf()without any length validation. -
The
sprintf()call writes the attacker-controlled data into the 104-byteacStack_90buffer on the stack. Because the input is larger than the buffer, it overwrites adjacent stack memory, including the saved return address of the calling function. -
When the function returns, execution jumps to the attacker-controlled address, and the attacker can run arbitrary code on the device.
No stage of this attack requires authentication. The entire exploitation chain is reachable over the network without any prior access to the device.
| Vulnerability Attribute | Detail |
|---|---|
| Affected Component | HTTP Handler (jhttpd) |
| Vulnerable File | /auto_reboot.asp |
| Vulnerable Function | sprintf |
| Buffer Size | 104 bytes (acStack_90) |
| Attack Vector | Remote Network |
| Authentication Required | None |
| CVSS Score | 9.8 |
| CWE Classifications | CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Buffer Copy without Checking Size of Input) |
Successful exploitation has a severe impact on all three parts of the CIA triad. An attacker with code execution on the router could extract stored credentials, change DNS settings to redirect traffic, install persistent backdoors, or crash the device into a denial-of-service condition that needs a manual power cycle to recover.
Affected Systems and Versions
The confirmed affected configuration is:
- Product: D-Link DI-8100
- Firmware Version: 16.07.26A1
- Status: End of Life / End of Service Life (all hardware revisions)
D-Link has classified all hardware revisions and firmware versions of the DI-8100 as legacy devices. No further firmware development will happen for this product line.
Vendor Security History
The DI-8100 has a pattern of similar vulnerabilities. In 2025, researchers reported more stack-based buffer overflows in other HTTP handlers on the same device, including the menu_nat_more.asp endpoint. These repeated findings point to systemic problems with memory management and input validation across the firmware's HTTP handling code. Unchecked sprintf() calls appear to be a recurring architectural weakness in the jhttpd daemon, not an isolated coding error.
