Tia N.List

Reported by 2 outlets

D-Link DIR-895L Critical RCE CVE-2026-100740

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.00 / 2.0 · best outlet weight
Severity
4.90 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.24 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
radar.offseq.comdeafnews.it CVE-2026-100740 first seen 17d ago

Analysis

D-Link DIR-895L routers carry CVE-2026-100740, a critical out-of-bounds write in tunnel_set_params scored CVSS 9.4 by radar.offseq.com and 9.9 by deafnews.it. The flaw allows remote unauthenticated RCE or DoS through the tunnel configuration endpoint. The device series reached end-of-life in 2019 and will receive no patch. Organizations running DIR-895L hardware should treat the exposure as unfixable and plan immediate replacement or strict network isolation.

The event sources are consistent: radar.offseq.com published the original advisory reference, and deafnews.it confirmed the EOL status and lack of vendor remediation. No observed exploitation campaigns or CISA KEV entry are reported. The vulnerability remains high severity because public exploit code is available and the target device is widely deployed in small-office and legacy consumer networks.

Timeline

  1. original reporting

    D-Link DIR-895L hit by CRITICAL vuln: CVE-2026-100740 (CVSS 9.4) in tunnel_set_params — public exploit code enables remote RCE or DoS via ou

    radar.offseq.com · 17d ago · September 27th, 2026

    D-Link DIR-895L hit by CRITICAL vuln: CVE-2026-100740 (CVSS 9.4) in tunnel_set_params — public exploit code enables remote RCE or DoS via ou

    via Mastodon https://radar.offseq.com/threat/cve-2026-100740-out-of-bounds-write-in-d-link-dir-895l-73af9e0aee6421f0

  2. update from deafnews.it

    D-Link DIR-895L routers hit by CVE-2026-100740, a CVSS 9.9 vulnerability. No patch coming: the series reached end-of-life in 2019. # Cyberse

    deafnews.it · 16d ago · September 27th, 2026

    No patch coming: the series reached end-of-life in 2019. # Cyberse

    via Mastodon https://deafnews.it/en/article/d-link-already-declared-eol-for-dir-895l-cve-2026-100740-gets-no-patch

Source on GitHub