CVE-2026-86510

CVE-2026-86510 is an out-of-bounds write (CWE-119/CWE-787) in the tunnel_set_params function of the L2TP Control Message Parser in D-Link DIR-822A firmware A_101. It is triggered when the parser handles crafted L2TP control messages; the CVSS 4.0 vector (AV:N/PR:L/UI:N) indicates the attack can be launched remotely over the network with low privileges and no user interaction. Successful exploitation corrupts memory beyond the intended buffer, and the high impact ratings in the CVSS score suggest it could lead to full device compromise or denial of service. Owners of D-Link DIR-822A routers are potentially affected, with exposure concentrated on devices that process L2TP control traffic (commonly used for ISP VPN-style connections). The exploit has been disclosed publicly and may be used, though the flaw is not yet in CISA KEV and EPSS currently assigns a 0.5% probability of exploitation within 30 days (39th percentile).

What to do: Check D-Link's support site for updated firmware for the DIR-822 A-series hardware and upgrade as soon as a patched release is available; no fixed version is named in the available data. Until patched, reduce exposure by disabling L2TP (or restricting UDP 1701 to trusted ISP endpoints only) and avoid exposing the router's management interface to the internet. Owners of this older model should note it may be near or past end-of-life, in which case replacing the device is the most reliable remediation.