D-Link warned customers about a maximum severity vulnerability (CVE-2026-86296) with public proof-of-concept (PoC) exploit code and no patch affecting older DIR-822A dual-band Wi-Fi routers.
This vulnerability is due to a stack-based buffer overflow and improper data processing in the DHCP server component and can be exploited without authentication or user interaction.
Attackers without valid credentials on the same local network can send crafted DHCP packets to the device, triggering the overflow and potentially crashing the DHCP daemon or achieving remote code execution on target devices.
D-Link also warned the security researcher who found and reported the issue has released a proof-of-concept (PoC) exploitwhich could allow attackers to more quickly exploit the vulnerability as a weapon in the wild.
“A specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function. Successful exploitation may result in memory corruption and allow an attacker to compromise the confidentiality, integrity or availability of the device,” the company said explained in a Friday consultation.
“This vulnerability affects the strcpy function of the udhcpcd/serverpacket.c file of the udhcpcd component. This manipulation results in a stack-based buffer overflow. The attack can be carried out remotely. The exploit has been publicly disclosed and can be exploited.”
D-Link is also investigating a second vulnerability public PoC exploit code Affected DIR-822A routers, a critical out-of-bounds write (CVE-2026-86510) in the L2TP control message parser reported by the same researcher.
Threat actors with basic privileges can exploit CVE-2026-86510 to trigger arbitrary memory corruption by manipulating input data to trigger an out-of-bounds write in attacks targeting devices configured to use L2TP or L2TPv6 WAN connectivity.
While D-Link is still investigating the two vulnerabilities and working on security patches, it recommends that its customers ensure that their DIR-822A routers are not available online, limit remote management access, and limit administrative access to trusted systems and users via a firewall or network access controls.
Although these vulnerabilities have not been flagged as exploited for attacks, attackers often target vulnerable D-Link devices. infect them with malware and add them to large botnets that are used for distributed denial-of-service (DDoS) attacks.
The Cybersecurity and Infrastructure Security Agency (CISA) Tracks 26 D-Link vulnerabilities which have been or are still being exploited in attacks, two of which have also been exploited by ransomware gangs.
