Do Son 
TL;DR
Security researchers revealed two severe D-Link DIR-822A vulnerabilities impacting wireless networking hardware. The flaws allow unauthenticated local attackers to trigger stack buffer overflows and execute arbitrary code. Crucially, full technical details of the vulnerability and functional proof-of-concept exploit code have been publicly disclosed.
- Product: D-Link DIR-822A
- Vulnerabilities: 2 flaws (CVE-2026-86296, CVE-2026-86510)
- Highest severity: 10.0 (Critical · CVSSv3)
- Worst impact: udhcpcd serverpacket.c strcpy stack-based overflow
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-86296 | 10 | udhcpcd serverpacket.c strcpy stack-based overflow | Not exploited |
| CVE-2026-86510 | 9.9 | L2TP Control Message tunnel_set_params out-of-bounds write | Not exploited |
Track every D-Link CVE the moment it's exploited.
Get free email alertsWhy It Matters
Network routers form the first defensive perimeter for connected homes and small offices. Sourced market estimates indicate that thousands of consumers deploy D-Link DIR-822A routers worldwide. Therefore, critical D-Link DIR-822A vulnerabilities create urgent risks for network security.
Both flaws earned critical severity scores from vulnerability scoring authorities. The primary flaw received a maximum CVSS rating of 10.0. Furthermore, the second flaw reached a CVSS score of 9.9. In an official advisory, the vendor confirmed that “a public proof-of-concept has also been reported.” Fortunately, security teams have not confirmed any active exploitation in the wild. However, the public disclosure of working exploit code drastically increases the likelihood of incoming automated botnet attacks.
How The Attack Works
The vulnerabilities target different network daemon routines within the router firmware. Both flaws stem from unsafe memory operations on untrusted incoming traffic.
Stack Buffer Overflow In Udhcpcd
The primary flaw, tracked as CVE-2026-86296, resides in the device DHCP server. An independent vulnerability analysis uncovered an unsafe string copy in the TR-111 parsing logic. Specifically, the routine parses vendor-specific option 125 subfields.
The researcher explained that “because the vulnerable path is reachable from unauthenticated DHCP client traffic on the local network, a remote attacker on the LAN can trigger memory corruption by sending a crafted DHCP message containing a malicious option 125 payload.” The parsing code treats length-delimited binary fields as null-terminated C strings. Consequently, the program copies unbounded data into fixed 256-byte stack buffers. An advisory confirmed that “a specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function.” This corruption can trigger daemon crashes or remote code execution.
Out-Of-Bounds Write In L2TP Daemon
The second flaw, tracked as CVE-2026-86510, impacts the L2TP control message parser. The vulnerability exists within the tunnel parameter configuration function. An attacker with network access sends malformed control packets to trigger an out-of-bounds write. This action destabilizes memory management and compromises device integrity.
Affected Versions
These issues impact the D-Link DIR-822A router running firmware version A_101. The vendor stated that “D-Link is reviewing the reported vulnerability, affected product scope, and available remediation options.” Engineers continue investigating whether additional hardware revisions or older releases share these flaws.
Patch Or Mitigation Steps
D-Link has not yet published patched firmware releases for these vulnerabilities. Instead, the vendor published a preliminary notice on its security publication page. Administrators should isolate the device immediately to reduce risk.
Users should disable remote management interfaces over external interfaces. In addition, restrict local network access to trusted devices only. Administrators must ensure guests cannot access internal administration ports. Companies should monitor vendor announcements for formal security updates. If D-Link retires the product, owners must replace the hardware promptly. Securing these D-Link DIR-822A vulnerabilities prevents unauthenticated network takeovers.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
