Public exploit code circulates for an unpatched 10.0 DHCP overflow in D-Link's DIR-822A
VulDB scored CVE-2026-86296 at 10.0 because a crafted DHCP request reaches the DIR-822A's udhcpcd with no credentials and no user interaction, while D-Link is still working out which hardware revisions are affected.
The Watch · Security desk
What happened
- CVE-2026-86296 is a stack-based buffer overflow in a strcpy call in udhcpcd/serverpacket.c on the D-Link DIR-822A, exploitable remotely with no authentication and no user interaction, with a public proof-of-concept reported.
- VulDB, the CNA that assigned the CVE, rated it 10.0 (Critical) on both CVSS v3.1 and CVSS v4.0, the top of both scales, and D-Link's advisory reprints those scores.
- The same researcher reported a second DIR-822A flaw, CVE-2026-86510, a critical out-of-bounds write in the L2TP control message parser that also has public exploit code.
Why it matters
- What doesn't add up contradiction D-Link's containment advice covers internet exposure and remote management, while the attack BleepingComputer describes arrives from an unauthenticated client on the LAN, so the published mitigations leave that path open.
- Who has to decide decision D-Link has said it will issue retirement and replacement guidance if the DIR-822A proves to be out of support, so owners are weighing a hardware purchase while they wait for a verdict on firmware.
- Who's exposed exposure Any DIR-822A sharing a network with untrusted clients is reachable using code anyone can download, and D-Link devices in that state are the stock that DDoS botnet operators harvest.
Next story · Security · 3d ago
Flock becomes the CVE authority for its own license plate readers and camerasConfirmed2 publishers
The DHCP server on the DIR-822A is udhcpcd, and the overflow sits in serverpacket.c, in a strcpy call that copies data out of a request without bounding it [1]. D-Link put the outcome in its own words on Friday: "A specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function. Successful exploitation may cause memory corruption and could allow an attacker to affect the device's confidentiality, integrity, or availability," the company said [5]. The CVE record is shorter: "The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized" [4].
Where the packet comes from decides what defenders can do. VulDB's vector says AV:N [17]. BleepingComputer's description is narrower: an attacker with no credentials on the same local network sends crafted DHCP packets and either kills the daemon or gets code execution [3]. D-Link's recommended actions are keeping the device off the public internet where it is not needed, restricting remote management, limiting administrative access with firewall or network-access controls, watching the regional support site, and flashing only firmware built for the exact hardware revision [11]. Each of those bounds the WAN side or the admin interface. A DHCP request from a laptop already on the LAN passes through all of them [20]. Containment for that path means keeping untrusted clients, guest wireless and whatever a visitor plugs into a wall port, off the same broadcast domain as the router's DHCP server [20].
The same researcher reported a second bug. CVE-2026-86510 is an out-of-bounds write in tunnel_set_params in the L2TP control message parser, also with public exploit code [6], and it applies to devices configured for L2TP or L2TPv6 WAN connectivity [7]. It scores 9.9 on CVSS v3.1 against the DHCP bug's 10.0 [12][16]. The two v3.1 vectors differ in one metric: PR:N on the DHCP overflow, PR:L on the L2TP write [21].
Anyone triaging from D-Link's page should check which CVE they are reading. The affected-product block for DIR-822A version A_101 lists the component as tunnel_set_params of the L2TP Control Message Parser [8], and the technical section carries both score pairs, 10.0/10.0 and 9.9/9.4 [16][12]. The product status line is "Under Investigation" [18], and D-Link is still verifying hardware revisions, regional scope, lifecycle status, and whether an updated firmware release is available or appropriate [9]. BleepingComputer reports the company is working on security patches [22]. If the DIR-822A turns out to be past support, D-Link says it will issue retirement and replacement guidance [10].
Neither flaw has been flagged as exploited in attacks [13]. CISA tracks 26 D-Link flaws that have been or are still exploited, two of them also abused by ransomware gangs [14], and vulnerable D-Link devices are routinely pulled into large-scale DDoS botnets [15]. The report came from a researcher D-Link credits as tian, through VulDB as CNA, filed as VDB-399458 [19].
What to watch
- A D-Link firmware release or a retirement notice for the DIR-822A, with the affected hardware revision list attached.
- Either CVE appearing in CISA's tracking of exploited D-Link flaws, which would move it from public PoC to confirmed in-the-wild use.
- Crafted DHCP traffic matching the published PoC turning up in the botnet loaders that already scan for D-Link gear.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence66
Perspective Coverage
3 publishers- Builder
- Builder 17%
- Operator
- Operator 75%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-86296 affects the D-Link DIR-822A and is a stack-based buffer overflow associated with the use of the strcpy function in udhcpcd/serverpacket.c, in the device's udhcpcd component.
- [2]
According to the published CVE information, CVE-2026-86296 may be exploited remotely without authentication or user interaction, and a public proof-of-concept has been reported.
- [3]
Attackers without valid credentials on the same local network can send crafted DHCP packets to the device, trigger the overflow, and potentially crash the DHCP daemon or achieve remote code execution on targeted devices.
- [4]
"The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized."
- [5]
"A specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function. Successful exploitation may cause memory corruption and could allow an attacker to affect the device's confidentiality, integrity, or availability," the company explained in a Friday advisory.
- [6]
D-Link is also investigating a second vulnerability with public PoC exploit code affecting DIR-822A routers, a critical out-of-bounds write (CVE-2026-86510) in the L2TP control message parser, reported by the same researcher.
- [7]
Threat actors with basic privileges may exploit CVE-2026-86510 to trigger arbitrary memory corruption via an out-of-bounds write against devices configured to use L2TP or L2TPv6 WAN connectivity.
- [8]
In the advisory's affected-product block for DIR-822A reported version A_101, the vulnerability type is given as Out-of-Bounds Write and the component as "function tunnel_set_params of the component L2TP Control Message Parser".
- [9]
D-Link says it is continuing to verify the applicable hardware revision or revisions, the geographic or regional product scope, the product lifecycle status, and whether an updated firmware release is available or appropriate.
- [10]
D-Link says that if it determines the affected product is no longer supported, it will provide appropriate product retirement and replacement guidance.
- [11]
D-Link's recommended customer actions are to ensure the device is not unnecessarily exposed to the public Internet, restrict remote management access unless required, use firewall or network-access controls to limit administrative access to trusted systems and users, monitor the applicable regional support site for updated firmware or guidance, and install only firmware intended for the exact product model and hardware revision.
- [12]
The advisory also publishes a CVSS v3.1 score of 9.9 (Critical) and a CVSS v4.0 score of 9.4 (Critical) for the record covering the tunnel_set_params out-of-bounds write, with v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R.
- [13]
D-Link has not flagged these vulnerabilities as exploited in attacks.
- [14]
CISA tracks 26 D-Link security flaws that have been or are still exploited in attacks, two of which ransomware gangs have also abused.
- [15]
Attackers often target vulnerable D-Link devices to build large-scale botnets used for distributed denial-of-service attacks.
- [16]
The CVE Numbering Authority assigned CVE-2026-86296 a CVSS v3.1 score of 10.0 (Critical) and a CVSS v4.0 score of 10.0 (Critical).
- [17]
The published CVSS v3.1 vector for the 10.0 score is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R.
- [18]
The advisory identifies the affected product as DIR-822A, reported version A_101, with status "Under Investigation".
- [19]
D-Link acknowledges security researcher tian for the report; the CVE Numbering Authority is VulDB and the VulDB reference is VDB-399458.
- [20]
None of D-Link's listed mitigations restricts a crafted DHCP request sent by an unauthenticated client already on the local network: each one bounds internet exposure, remote management, or administrative access, so the only control that touches the described path is separating untrusted clients from the DHCP server's broadcast domain.
- [21]
The two published CVSS v3.1 vectors differ in a single metric, privileges required: PR:N on the udhcpcd overflow scored 10.0 and PR:L on the L2TP out-of-bounds write scored 9.9.
- [22]
BleepingComputer reports that D-Link is still investigating the two flaws and working on security patches.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comD-Link warns of max severity zero-day bug in DIR-822A routers
1 article · September 22, 2026
- scworld.comD-Link warns of critical vulnerabilities in legacy DIR-822A routers with public exploit code
1 article · September 23, 2026
- D-Link CVE-2026-86296
supportannouncement.us.dlink.com
1 article · September 22, 2026