D-Link DIR-822A routers exposed to unpatched CVSS 10.0 unauthenticated DHCP overflow and 9.9 L2TP flaw, both with public PoCs

D-Link advisory SAP10516 discloses CVE-2026-86296, a CVSS 10.0 unauthenticated stack buffer overflow in DIR-822A firmware A_101's udhcpcd, plus CVE-2026-86510, a CVSS 9.9 L2TP out-of-bounds write; public PoCs exist for both and no patch is available.

D-Link is warning about CVE-2026-86296, a maximum-severity stack-based buffer overflow in legacy DIR-822A routers, disclosed under advisory SAP10516 (published September 18, updated September 21, per GBHackers). All three reports place the flaw in the udhcpcd component of firmware A_101, caused by an unsafe strcpy of attacker-controlled data into a fixed-size buffer; GBHackers and BleepingComputer identify it as DHCP-related, with GBHackers pinpointing serverpacket.c. The bug scores 10.0 under both CVSS v3.1 and v4.0 (GBHackers) and is remotely exploitable with no privileges and no user interaction; crafted DHCP packets can crash the daemon or enable unauthenticated remote code execution, and a public proof-of-concept exists. A second flaw, CVE-2026-86510 (CVSS 9.9), is a critical out-of-bounds write in the L2TP Control Message Parser's tunnel_set_params function requiring low privileges, which also has public PoC code. No firmware fix has been released; D-Link advises removing internet exposure and restricting remote management (GBHackers). Sources disagree on scope: GBHackers limits impact to non-US DIR-822A units, while Cyber Security News says D-Link has not yet confirmed affected hardware revisions or regional scope. BleepingComputer treats the bug as a zero-day and notes D-Link has not said either issue is being exploited, though its devices are frequent botnet targets.

• CVE-2026-86296: CVSS 10.0 (v3.1 and v4.0 per GBHackers) unauthenticated stack-based buffer overflow in the udhcpcd component (serverpacket.c per GBHackers) of D-Link DIR-822A firmware A_101, caused by unsafe strcpy into a fixed-size buffer
• Attack characteristics: network attack vector, no privileges required, no user interaction; crafted DHCP packets can crash the daemon or lead to unauthenticated remote code execution
• Public proof-of-concept code has reportedly been released for both CVE-2026-86296 and CVE-2026-86510
• CVE-2026-86510: CVSS 9.9 out-of-bounds write in the L2TP Control Message Parser's tunnel_set_params function, requiring low privileges
• D-Link advisory SAP10516 was published September 18 and updated September 21 (GBHackers)
• No patch or fixed firmware has been released; D-Link advises removing internet exposure and restricting remote management (GBHackers)
• Scope disagreement: GBHackers says non-US DIR-822A routers only; Cyber Security News says D-Link has not confirmed affected hardware revisions, regional scope, or fixed firmware