D-Link Router Hit by CVSS 10.0 Flaw Exploitable Remotely Without Authentication
D-Link disclosed CVE-2026-86296, a CVSS 10.0 unauthenticated stack buffer overflow in DIR-822A routers, with a public PoC reportedly released.
CVE-2026-86296 is a stack-based buffer overflow in the udhcpcd component of D-Link DIR-822A firmware A_101, caused by unsafe strcpy of attacker-controlled data into a fixed-size buffer, and carries the maximum CVSS 10.0 score with network attack vector, no privileges, and no user interaction. Successful exploitation could crash the device or allow unauthenticated remote code execution, and a public proof-of-concept has reportedly been released. D-Link also confirmed a second critical flaw, CVE-2026-86510 (CVSS 9.9), an out-of-bounds write in the L2TP Control Message Parser's tunnel_set_params function requiring low privileges. D-Link has not yet confirmed affected hardware revisions, regional scope, or fixed firmware.
- CVE-2026-86296: CVSS 10.0 unauthenticated stack buffer overflow in DIR-822A udhcpcd component
- Public proof-of-concept reportedly released for both flaws
- CVE-2026-86510: CVSS 9.9 out-of-bounds write in L2TP parser requiring low privileges
- D-Link still validating affected hardware revisions and firmware remediation
- Organizations
- D-Link
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86296 | Stack-Based Buffer Overflow in D-Link DIR-822A udhcpcd DHCP Component | 9.3 | 1% | ||
| CVE-2026-86510 | Out-of-Bounds Write in D-Link DIR-822A L2TP Control Message Parser | 8.6 | <1% |
From the original article
2 min read at cybersecuritynews.com
D-Link Systems has disclosed that it is investigating a critical security vulnerability in its DIR-822A router, tracked as CVE-2026-86296. The flaw has received the maximum CVSS severity score of 10. 0.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.