D-Link DIR-822A: Pre-authentication DHCP Buffer Overflow and L2TP Out-of-Bounds Write

1. Basic Information

• Original Title: (Non-US) DIR-822A – Stack-Based Buffer Overflow Vulnerability Reported
• Published by: D-Link
• Publication Date: 2026-09-18
• Updated Date: 2026-09-21
• Collection Date: 2026-09-23T08:14:06+09:00
• Source: D-Link Security Announcement
• Severity: High
• Basis of Severity: DIR-822A A_101 contains CVE-2026-86296 (CVSS v3.1 10.0), which is unauthenticated and network-reachable, and CVE-2026-86510 (CVSS v3.1 9.9), which requires low privileges. Public PoCs are reported for both, but real-world exploitation and stable code execution have not been confirmed. D-Link is investigating the impact scope and firmware updates.
• References: BleepingComputer: D-Link warns of max severity zero-day bug in DIR-822A routers
• References: CVE.org: CVE-2026-86296
• References: CVE.org: CVE-2026-86510
• Related Malware: None
• Related Threat Actor: Unidentified
• CVE: CVE-2026-86296, CVE-2026-86510
• Target Products and Services: D-Link DIR-822A firmware A_101

2. Quick Summary

In DIR-822A A_101, an unauthenticated attacker on the same local network can trigger a stack-based buffer overflow in udhcpcd using a crafted DHCP packet, and an out-of-bounds write in L2TP processing can be reached by low-privileged users. Public PoCs exist, but real-world exploitation has not been confirmed.

3. Attack Flow

The following are two separate vectors published by D-Link. Public information indicates the existence of vulnerabilities and PoCs, but these are not paths used in actual attacks.

Vector A: CVE-2026-86296 (udhcpcd)

1. An unauthenticated attacker able to reach the router’s DHCP processing sends a crafted DHCP packet.
2. Improper use of strcpy in udhcpcd/serverpacket.c causes a stack-based buffer overflow.
3. This may cause router crashes or, depending on conditions, impact confidentiality, integrity, and availability. Stable code execution has not been confirmed in public information.

Vector B: CVE-2026-86510 (L2TP)

1. A low-privileged attacker sends crafted parameters to the L2TP tunnel_set_params routine.
2. An out-of-bounds write occurs, which may lead to process crashes or memory corruption.
3. D-Link indicates remote reachability, though it is not unauthenticated. Real-world exploitation and stable code execution have not been confirmed.

4. Attacker Position and Execution Environment

• CVE-2026-86296 requires an unauthenticated attacker able to send DHCP traffic to the router, such as an attacker on the same local network or an otherwise attacker-reachable DHCP segment.
• CVE-2026-86510 assumes a low-privileged user with access to L2TP processing.
• Memory corruption occurs in udhcpcd or L2TP-related processing on the DIR-822A.

5. Indicators for Victims and Administrators

Victims

• If successful, it may manifest as communication loss, router reboots, or unstable connections.

Administrators

• Clues include process stoppages occurring immediately after abnormal network input, router reboots, reset uptime, and L2TP-related errors. Embedded devices may lack sufficient logs.

6. Success and Failure Conditions

Success Conditions

• The target is DIR-822A firmware A_101, and the network processing function is reachable.
• For CVE-2026-86510, the router is configured to use L2TP or L2TPv6 for WAN connectivity, and the attacker has low-privileged authenticated access.
• Crafted input reaches the vulnerable routine and triggers memory corruption.

Failure and Blocking Conditions

• Verify the target hardware and firmware and apply patches once D-Link releases fixes.
• Until patches are available, restrict remote management, prevent untrusted devices from joining local network segments, monitor for rogue DHCP servers and anomalous DHCP responses, and disable L2TP/L2TPv6 WAN connectivity if it is not required.
• Plan to replace devices that are out of support or lack expected firmware updates with supported products.

7. What Happens Upon Success

• Availability impacts such as process termination, router reboots, and communication loss may occur.
• While memory corruption could theoretically evolve into confidentiality/integrity impacts or code execution, public information does not clarify the scope and stability of exploitation.
• Real-world compromises, configuration changes, credential theft, and botnet inclusion have not been confirmed.

8. Observable Logs

• email: No email-based attack vectors have been reported.
• proxy_swg_dns: No web or DNS vectors specific to this issue have been published.
• endpoint_edr: For devices where standard EDR cannot be installed, check syslog, crash records, uptime, and differences between configuration backups.
• identity_idp: For CVE-2026-86510, if L2TP or device management authentication logs are available, check timestamps and source addresses associated with low-privileged accounts.
• saas_cloud: If cloud management services are used, check histories of reboots, configuration changes, and connection states.
• network: For CVE-2026-86296, check for DHCP responses from unauthorized servers, malformed or unusually large DHCP options, followed by udhcpcd failure or router reboot. For CVE-2026-86510, correlate malformed L2TP control messages with L2TP process termination, tunnel disconnection, or router instability.

9. Attack Success Determination

Confirmed via Public Information

• Public PoC Available (Real-World Success Unconfirmed): PoCs have been reported for both CVEs, but D-Link has not confirmed real-world exploitation, code execution, or post-exploitation activities.

Internal Evaluation Criteria

• Confirm Contact: Use network records to verify that potentially crafted input has reached the target device.
• Confirm Vulnerability Trigger: Corroborate simultaneous process stops, crashes, reboots, or memory corruption traces via device logs or external monitoring.
• Confirm Subsequent Compromise: Verify configuration changes, unknown management sessions, external communications, or persistence through separate evidence.

10. Investigation Playbook

Trigger

• Triggered by ownership of DIR-822A A_101, unexpected reboots, L2TP disconnections, or suspicious input to the vulnerable routines.

Initial Checks

• Verify hardware revision, firmware version, vulnerable services, external reachability, and recent reboot times.
• Recheck D-Link's latest advisory for impact scope and patch availability.

Endpoints

• Preserve syslog, crash records, uptime metrics, configuration files, and firmware images.

Authentication and Cloud

• Check L2TP and management account authentication logs, cloud management operation logs, and configuration changes.

Subsequent Operations

• Track management logins, configuration changes, DNS changes, outbound communications, and contact from the same source to other devices following the anomaly.

Containment

• Isolate the device from unnecessary external paths, limiting connection sources to management interfaces and vulnerable services.
• Apply patches if released, or replace with supported products if no patch is provided.
• If compromise is suspected, rebuild from a known-good configuration and change management credentials.

Decision Categories

• Evaluate separately: PoC acquisition, network reachability, crashes, code execution, configuration changes, and subsequent compromise.

11. Defense and Detection Ideas

Single Events

• Detect unexpected reboots of DIR-822A, termination of L2TP-related processes, and uptime resets with high priority.

Chronological Correlation

• Correlate network input, session disconnections, unresponsiveness, reboots, management logins, and configuration changes on the same device chronologically.

Hunting Perspective

• Extract DIR-822A A_101 from asset inventories and verify external reachability, L2TP usage, recent reboots, and configuration diffs.

Log Limitations

• Internal router logs alone may be insufficient to identify memory corruption or reboot causes. Combine with upstream firewalls, network monitoring, and external liveness monitoring.

Priority Mitigations

• Monitor D-Link updates and prioritize applying patches or replacing devices.
• In the interim, reduce external reachability of management interfaces and unnecessary services, applying ACLs and network segmentation.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-86296 is a stack-based buffer overflow in udhcpcd on DIR-822A A_101, requiring no authentication or user interaction.
• CVE-2026-86510 is an out-of-bounds write in L2TP tunnel_set_params processing, requiring low privileges.
• Public PoCs have been reported for both CVEs.
• D-Link is investigating the impact scope and firmware updates and has not confirmed real-world exploitation.

Inference

• Public PoCs increase the likelihood of probing, but the two attack surfaces differ: CVE-2026-86296 requires reachability to the router’s DHCP processing, while CVE-2026-86510 requires low privileges and an applicable L2TP/L2TPv6 WAN configuration.

Hypothesis

• Botnet operators may incorporate these into existing router scanning routines, though no such activity has been confirmed.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (Confidence: Low) — Potentially applicable only when an affected L2TP or other vulnerable network-facing interface is exposed to an attacker. No real-world exploitation has been confirmed.

14. Unknowns and Additional Investigation

• Presence of real-world exploitation, stable code execution, and post-exploitation activities.
• Impact scope on firmware versions and hardware revisions other than A_101.
• Version numbers and release dates of patches provided by D-Link.
• Impact scope and reproduction conditions demonstrated by each PoC.

15. Impact on SOCs and Organizations

Do not rely solely on the DIR-822A model number; verify hardware revisions and running firmware in the asset inventory. While patches remain pending, inventory externally reachable devices and exposed services, L2TP usage, and management interface connection sources, and reduce exposure using ACLs and network segmentation. Given the limitation of embedded device logs, complement internal data with upstream network telemetry and external liveness monitoring to track crashes and reboots.

16. Summary by Stakeholder

• For SOCs: Chronologically correlate suspicious input to DIR-822A A_101 with subsequent L2TP disconnections, unresponsiveness, reboots, and management operations.
• For Administrators: Continuously check D-Link patch information and restrict management interfaces and unnecessary external paths. Plan device replacements if patches are not provided.
• For Users: If communication loss or router reboots persist, contact administrators without factory-resetting the device.