A critical stack-based buffer overflow in D-Link DI-8400 version 16.07 allows for remote code execution, necessitating immediate restrictive access controls.

The vulnerability exists in the ddns_asp function within the /ddns.asp endpoint, where unsanitized input passed to multiple arguments (serv, user, host, wild, mx, bmx, cust, ip) triggers a stack-based buffer overflow. While the attack is initiated remotely, it requires the attacker to be authenticated with valid credentials to access the DDNS configuration page.

Successful exploitation of this flaw allows a remote attacker to achieve arbitrary code execution on the affected D-Link device. Given the CVSS score of 9.9, this vulnerability poses an extreme risk, as it could lead to full device compromise, unauthorized network traffic interception, or the use of the router as a pivot point for further lateral movement within the internal network.

Immediate Action: Since no official patch is currently available, immediately restrict access to the web management interface of the D-Link DI-8400 to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /ddns.asp and review system logs for recurring service crashes or unexpected administrative sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long strings sent to the DDNS configuration parameters.

Public Exploit Available: Yes, a proof-of-concept exploit script is publicly available via the researcher write-up on GitHub.

The severity of this vulnerability, combined with the availability of a functional exploit script, creates a significant security risk for environments utilizing D-Link DI-8400 routers. Administrators must prioritize isolating the management interface from the public internet immediately and remain vigilant for vendor-supplied firmware updates to remediate the underlying memory corruption issue.