D-Link warns of max severity zero-day bug in DIR-822A routers
D-Link warns of an unpatched maximum-severity DHCP buffer overflow in legacy DIR-822A routers, with public proof-of-concept code.
D-Link warned that legacy DIR-822A routers are affected by CVE-2026-86296, a maximum-severity unauthenticated stack-based buffer overflow in the DHCP server via strcpy in udhcpcd. A public proof-of-concept exists and no patch is available; crafted DHCP packets can crash the daemon or lead to remote code execution. A second flaw, CVE-2026-86510, is a critical out-of-bounds write in the L2TP control-message parser, also with public PoC code. D-Link has not said either issue is being exploited.
- Unauthenticated DHCP overflow CVE-2026-86296 can crash DIR-822A or run code.
- A public proof of concept exists and D-Link has no patch yet.
- CVE-2026-86510 is a critical L2TP parser out-of-bounds write with public PoC.
- D-Link has not confirmed exploitation, though its devices are frequent botnet targets.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86296 | Stack-Based Buffer Overflow in D-Link DIR-822A udhcpcd DHCP Component | 9.3 | 1% | ||
| CVE-2026-86510 | Out-of-Bounds Write in D-Link DIR-822A L2TP Control Message Parser | 8.6 | <1% |
From the original article
2 min read at bleepingcomputer.com
D-Link warned customers of a maximum-severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.