CVE-2026-91001

D-Link DI-8400 router firmware 16.07 contains a stack-based buffer overflow (CWE-121) in the ddns_asp function of the /ddns.asp DDNS Configuration page, reachable remotely through the web management interface. An attacker with low privileges (an authenticated session able to reach the DDNS settings) triggers the overflow by supplying overly long values in the serv, user, host, wild, mx, bmx, cust, or ip parameters, overwriting the stack and potentially executing arbitrary code on the router. Successful exploitation gives full control of the device, which typically sits at the network edge and can be used to intercept traffic, pivot inward, or enroll the router in botnets. Only D-Link DI-8400 running version 16.07 is reported affected; this is an older enterprise router primarily distributed in the Asian market. The VulDB description states an exploit has been disclosed publicly, but no confirmed public PoC is currently tracked and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so treat exploitation status as unconfirmed.

What to do: Check D-Link's security advisories for a firmware update for the DI-8400 and apply it if one exists; the device appears to be at or near end-of-support, so plan replacement if no patch is issued. Immediately remove the web management interface (/ddns.asp and the admin GUI) from internet exposure by restricting it to a trusted LAN segment or VPN, and audit the DDNS configuration and device logs for unexpected parameter values or unfamiliar admin sessions. Rotate admin credentials as a precaution if the device was exposed.