DEV Community

yutianle
yutianle

Posted on

D-Link DIR-822A Routers Expose Critical DHCP and L2TP Flaws With Public PoC

#vulnerability #dlink #router #cve202686296

D-Link DIR-822A: Two Critical Flaws, No Patch, and Public Exploit Code

Vulnerability overview

Security researchers disclosed two critical vulnerabilities in the D-Link DIR-822A wireless router on September 22, 2026. CVE-2026-86296, a stack-based buffer overflow in the DHCP server, holds a CVSS v3 score of 10.0. CVE-2026-86510, an out-of-bounds write in the L2TP control message parser, scores 9.9. Full technical details and functional proof-of-concept exploit code are public.

Mechanism and exploitation conditions

The DHCP flaw is an unsafe string copy in TR-111 parsing logic. The routine handles vendor-specific option 125 subfields and copies length-delimited binary data into a fixed 256-byte stack buffer using strcpy. Because the copy is unbounded, a crafted DHCP message with an oversized option 125 payload overwrites adjacent stack memory. The vulnerable path is reachable from unauthenticated DHCP client traffic on the local network.
The L2TP flaw is a separate write in the tunnel parameter configuration function. An attacker with network access sends malformed L2TP control packets, and the parser writes values past the end of the destination structure. Both flaws follow the same shape: the device trusts a length or size value from the network and writes into fixed storage.

Impact

Each flaw can crash a privileged daemon or give an attacker code execution on the router. A compromised router exposes everything behind it. The device can be used to intercept or redirect traffic, to join a botnet, or as a staging point for attacks on the internal network. A crash alone is disruptive, since the DHCP server handles address assignment for every connected client.

Affected products and scope

The affected configuration is the D-Link DIR-822A running firmware A_101. D-Link confirmed in its advisory that a public proof-of-concept has been reported and stated that it is reviewing the reported vulnerability, affected product scope, and available remediation options. No exploitation in the wild has been confirmed, but public exploit code raises the likelihood of automated attacks.

Exposure context

ZoomEye reports 65,758 assets matching the D-Link router fingerprint app="D-Link Router" and 623 matching title="DIR-822". The first figure covers the product family as ZoomEye fingerprints it; the second is a narrower title match. Neither is a vulnerability scan, so both describe candidate populations rather than confirmed vulnerable hosts.

Remediation and mitigations

D-Link has not published patched firmware. Until it does, isolate the device from untrusted networks, disable remote management over external interfaces, restrict local access to trusted devices, and prevent guest clients from reaching administration ports. If D-Link retires the product without a fix, replace the hardware. Monitor the vendor's security publication page for updates.

References

Top comments (0)