CVE-2026-86297

CVE-2026-86297 is an off-by-one memory-handling flaw in the tunnel_set_params function of the L2TP Control Message Parser (file progs.gpl/pppd.alpha/l2tp/tunnel.c) in D-Link DIR-605 firmware build B1v202WWB03. A remote attacker triggers it by sending a crafted L2TP control message whose peer_hostname argument is handled one element past the intended boundary, causing memory corruption on the device. Per the CVSS 4.0 scoring, successful exploitation can have high impact on the router's confidentiality, integrity, and availability (for example a crash or potential code execution), although the attack is described as highly complex and difficult to execute. Operators of D-Link DIR-605 B1 routers running the named firmware are affected, particularly where L2TP is in use or passed through. The advisory notes the exploit is publicly available and might be used, but no confirmed in-the-wild exploitation is documented (1% EPSS over 30 days, not in CISA KEV).

What to do: Inventory for DIR-605 routers running the B1v202WWB03 build and check whether L2TP is enabled; if L2TP is not required, disable it or restrict WAN exposure of L2TP control traffic. Because this model is end-of-life, check D-Link's support site for any updated firmware or plan replacement, and monitor for exploitation activity given that a public exploit exists.