This vulnerability involves a buffer overflow in the sprintf function within the /user_group.asp CGI handler of D-Link DI-8100 firmware version 16.07.26A1. An attacker with high privileges can remotely manipulate input to cause this overflow, potentially leading to arbitrary code execution or denial of service. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or patch at this time.

Successful exploitation of this buffer overflow could allow an attacker with high privileges to execute arbitrary code remotely or disrupt the device's normal operation, compromising confidentiality, integrity, and availability of the affected device. The vulnerability is exploitable remotely and does not require user interaction, increasing its risk. However, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit network exposure of the affected device, restrict access to trusted users, and monitor for unusual activity. Avoid using the vulnerable firmware version 16.07.26A1 if possible.