DEV Community

jeffrey
jeffrey

Posted on

D-Link DIR-822A Routers Expose Critical DHCP and L2TP Flaws With Public PoC

#vulnerability #dlink #router #cve202686296

Router Memory Corruption in 2026: Lessons From the D-Link DIR-822A Disclosures

Vulnerability overview

Two memory-safety flaws in the D-Link DIR-822A were disclosed with public proof-of-concept code. CVE-2026-86296 is a stack-based buffer overflow in the DHCP server, rated 10.0. CVE-2026-86510 is an out-of-bounds write in the L2TP control message parser, rated 9.9. Both are unauthenticated from the attacker's position on the local network, and both trace back to parsing code that trusts attacker-supplied lengths.

Mechanism and exploitation conditions

The DHCP flaw sits in TR-111 option parsing. The daemon reads vendor-specific option 125 subfields, treats length-delimited binary data as a C string, and copies it with strcpy into a 256-byte stack buffer. The L2TP flaw writes parsed control-message fields into tunnel parameter storage without checking their size. In each case the attacker supplies a crafted packet and the device writes past the end of a fixed buffer.
What makes this pair worth studying is the pattern rather than either bug. Embedded firmware often ships a small DHCP server, an L2TP daemon, and a web management CGI, each written at different times by different people, each parsing untrusted input with the same assumption that the peer will send well-formed data. That assumption holds until someone sends something else.

Impact

Memory corruption in a router daemon leads to a crash or to code execution in a privileged process. A crash interrupts the service the daemon provides; code execution gives the attacker the device. Routers are attractive targets because they are rarely monitored, they sit on the network edge, and they can be conscripted into botnets or used as a pivot into the networks behind them.

Affected products and scope

The DIR-822A running firmware A_101 is the reported affected configuration. D-Link is still reviewing the affected product scope and remediation options, and no in-the-wild exploitation has been confirmed. The lack of confirmed exploitation does not reduce the risk: published working exploit code removes the research effort an attacker would otherwise need.

Exposure context

ZoomEye identifies 65,758 assets matching app="D-Link Router" and 623 matching title="DIR-822". The gap between those numbers is itself informative. A broad vendor fingerprint captures the family, while a title filter captures devices that announce the specific model. Neither query confirms a firmware version, so exposure figures describe the size of the candidate population, not the size of the vulnerable population.

Remediation and mitigations

With no vendor patch available, mitigation is architectural. Segment the router so that untrusted clients cannot reach its service and management interfaces, disable remote administration, and plan to replace the device if D-Link does not ship firmware. For defenders running mixed fleets, the broader lesson is to inventory consumer-grade routers on the network and track whether each one still receives firmware updates.

References

Top comments (0)