CVE-2026-10206: D-Link DI-8400 dbsrv.asp stack-based overflow

Synopsis

A stack-based buffer overflow exists in the D-Link DI-8400 router firmware (up to version 16.07.26A1), triggered by sending a crafted value for the str argument to the /dbsrv.asp endpoint. The vulnerability is reachable over the network and requires a low-privilege account, meaning any authenticated user can attempt it. Successful exploitation gives an attacker full control over memory on the affected device, enabling arbitrary code execution, data theft, or complete service disruption. No vendor patch has been published; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint /dbsrv.asp is exposed over the network, so an attacker must be able to reach the device's web interface remotely.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning a low-privilege account is sufficient; any authenticated user on the device can send the malicious request.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends the crafted request directly to the endpoint without requiring any action from another user.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads data held in device memory, including stored credentials and session tokens.
• Overwrites the stack to redirect execution, enabling the attacker to run arbitrary code on the router.
• Crashes the dbsrv.asp handler or the broader device web service, disrupting routing and administrative access.
• Full device compromise allows an attacker to pivot into the local network behind the router.