Reported by 8 outlets
D-Link DIR-822A critical vulnerabilities with public PoC exploit code
Why this score
- Breadth
- 2.00 / 2.0 · 8 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.32 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-86296 is a CVSS 10.0 stack-based buffer overflow (CWE-121) in the udhcpcd DHCP server of the D-Link DIR-822A, a non-US router model, reported on firmware A_101. The researcher tzh00203, whom D-Link acknowledges as tian, published a working writeup and Scapy PoC: valid_tr111_cpe_parse() in udhcpcd/serverpacket.c parses TR-111 vendor option 125 with enterprise code 3561 and copies suboption types 1, 2, and 3 into fixed 256-byte stack buffers with strcpy(), although DHCP option data is length-delimited and not NUL-terminated, so the copy runs past the suboption boundary. The parser is reached from sendOffer() and sendACK() during ordinary DHCPDISCOVER or DHCPREQUEST handling, so any unauthenticated client on the LAN can trigger it. D-Link's advisory SAP10516, published September 18 and updated September 21, also lists companion CVE-2026-86510, a CVSS 9.9 out-of-bounds write in tunnel_set_params of the L2TP Control Message Parser. Both remain Under Investigation with no firmware update, and the affected hardware revision and regional scope are unconfirmed.
The mechanism defines the blast radius: the target is the gateway's own DHCP daemon, so a single hostile or already-compromised LAN device can crash udhcpd with one packet, and a router that stops issuing leases takes every device on the network offline, an availability impact that needs no code execution at all. If the overflow yields the RCE the CVSS scope-changed vector assumes, the attacker owns the default gateway and with it DNS and traffic paths for the entire segment, which is why hotel, cafe, office, and shared networks carry the most exposure. The timeline is the real story: the VulDB CNA published the CVE-2026-86296 record on September 7 and CVE-2026-86510 on September 8, both already citing the public PoC pages, so weaponizable exploit detail existed eleven days before D-Link acknowledged the flaws on September 18, and there is still no patch and no confirmed hardware scope as of September 28. D-Link routers are a standing botnet target, CISA already tracks 26 exploited D-Link flaws, and a second public PoC doubles the surface, so treating every DIR-822A as vulnerable rather than waiting for scope confirmation is the defensible posture.
There is no fixed version to install, so mitigation and detection carry the load. Inventory for DIR-822A units, read the hardware revision from the label, and assume firmware A_101 is affected; the researcher notes exploitation requires a build compiled with TR069_FOR_TR111_OPTION and TR-111 handling enabled. Keep the router off the public internet, disable remote management, restrict administrative access to trusted hosts through firewall rules, and plan replacement, since D-Link's lifecycle language points toward retirement guidance. The specific hunt: DHCPDISCOVER or DHCPREQUEST frames carrying option 125 with enterprise identifier 3561 and TR-111 suboptions 1 through 3 holding long non-NUL-terminated payloads, udhcpd crashes or restarts in router syslog, and clients logging failed lease renewals with 169.254.0.0/16 link-local fallback; DHCP snooping on switches catches the crafted floods. Any DIR-822A with an L2TP or L2TPv6 WAN connection should be checked first for CVE-2026-86510, where oversized Host Name AVPs in L2TP control packets are the trigger.
Two developments would change the assessment. A SAP10516 update that confirms hardware revisions and ships firmware, or delivers EOL retirement guidance, converts this from an unpatchable zero-day into a routine n-day with a patch target. The other is exploitation telemetry: botnet-family scanning payloads referencing either CVE, a CISA KEV listing, or a public chain demonstrating RCE beyond the crash the current PoC shows would move this from preventive hardening to assume-breach response for every exposed deployment.
Timeline
-
original reporting
Public PoC exploit details emerge for critical D-Link DIR-822A vulnerabilities. Learn how these D-Link DIR-822A vulnerabilities impact unpat
securityonline.info · 22d ago · September 22nd, 2026
Public PoC exploit details emerge for critical D-Link DIR-822A vulnerabilities. Learn how these D-Link DIR-822A vulnerabilities impact unpat
via Mastodon https://securityonline.info/d-link-dir-822a-vulnerabilities-poc/?utm_source=mastodon&utm_medium=jetpack_social
-
update from cveawg.mitre.org
CVE-2026-86296 (VulDB CNA record, VDB-399458) published eleven days before D-Link's advisory
cveawg.mitre.org · 36d ago · September 7th, 2026
The VulDB CNA published the CVE-2026-86296 record on 2026-09-07 (dateReserved 2026-09-06), describing strcpy on udhcpcd/serverpacket.c in D-Link DIR-822A A_101 with a remote, unauthenticated attack vector, and citing VulDB entry VDB-399458 and submit 906297. The record's reference list already includes the researcher's disclosure page at tzh00203.notion.site, confirming the PoC writeup was public before this date, roughly two weeks ahead of D-Link's SAP10516 acknowledgment and three weeks before mainstream coverage.
-
update from cveawg.mitre.org
CVE-2026-86510 (VulDB CNA record, VDB-399663): DIR-822A L2TP Host Name AVP out-of-bounds write
cveawg.mitre.org · 36d ago · September 8th, 2026
The VulDB CNA published the companion CVE-2026-86510 record on 2026-09-08, describing an out-of-bounds write in the tunnel_set_params function of the DIR-822A L2TP Control Message Parser, reachable remotely with low privileges and carrying a public proof-of-concept (VulDB VDB-399663, submit 906300). The same tzh00203 Notion disclosure page is listed as a reference, and the researcher's writeup states the trigger is an oversized Host Name AVP in L2TP control traffic against devices using L2TP or L2TPv6 WAN connectivity.
-
update from supportannouncement.us.dlink.com
D-Link advisory SAP10516: (Non-US) DIR-822A - Stack-Based Buffer Overflow Vulnerability Reported
supportannouncement.us.dlink.com · 25d ago · September 18th, 2026
D-Link published SAP10516 on 18 September 2026 at 09:26 GMT and last updated it 21 September, listing CVE-2026-86296 (stack-based overflow via strcpy in udhcpcd/serverpacket.c, CVSS 10.0 on both v3.1 and v4.0) and companion CVE-2026-86510 (out-of-bounds write in tunnel_set_params of the L2TP Control Message Parser, CVSS 9.9 v3.1 / 9.4 v4.0), both on DIR-822A firmware A_101 and both reported by researcher tian. Hardware revision, regional scope, lifecycle status, and firmware-update availability are all marked Under Confirmation or Under Investigation, so no patch exists yet; D-Link advises keeping the router off the public internet, restricting remote management, and firewalling administrative access.
-
update from cyberpress.org
D-Link DIR-822A Router Hit by CVSS 10.0 Flaw Exploitable Remotely Without Authentication
cyberpress.org · 21d ago · September 22nd, 2026
D-Link has disclosed a critical security vulnerability in its DIR-822A router that could allow unauthenticated remote attackers to compromise vulnerable devices. The flaw, tracked as CVE-2026-86296, carries a maximum CVSS v3.1 severity rating of 10.0 and is linked to a stack-based buffer overflow in the router’s udhcpcd component. D-Link said the issue remains under investigation as it verifies the affected hardware revisions, regional product scope, product lifecycle status, and whether it can release a firmware update. D-Link DIR-822A Router Hit by CVSS 10.0 Flaw According to the advisory, the vulnerability affects the DIR-822A running the reported firmware version A_101. The issue exists in udhcpcd/serverpacket.c , where the component uses the unsafe strcpy function when handling data. An attacker could send specially crafted network traffic that exceeds the available stack buffer, causing memory corruption on the device. Because the flaw can be exploited over the network, requires no authentication, and needs no user interaction, it poses a significant risk to internet-exposed routers. The published CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R , indicating low attack complexity and potentially high impact on confidentiality, integrity, and availability. A public proof-of-concept exploit has also been reported, increasing the likelihood that threat actors could attempt to weaponize the vulnerability. D-Link acknowledged security researcher
-
update from gbhackers.com
D-Link DIR-822A Router Vulnerability Scores CVSS 10.0 With Public PoC Available
gbhackers.com · 21d ago · September 22nd, 2026
The company published advisory SAP10516 on September 18 and updated it […] The post D-Link DIR-822A Router Vulnerability Scores CVSS 10.0 With Public PoC Available appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from bleepingcomputer.com
D-Link warns of max severity zero-day bug in DIR-822A routers
bleepingcomputer.com · 21d ago · September 22nd, 2026
Attackers without valid credentials on the same local network can send crafted DHCP packets to the device, trigger the overflow, and potentially crash the DHCP daemon or achieve remote code execution on targeted devices. "A specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function. The attack is possible to be carried out remotely.
-
mentioned by www.bleepingcomputer.com
🤖 D-Link warns of max-severity zero-day (CVE-2026-86296) in legacy DIR-822A routers: public PoC exploit code, no patch available. Devices ar
www.bleepingcomputer.com · 21d ago · September 22nd, 2026
-
update from www.clubic.com
[VULN] D-Link alerts on a maximum severity flaw in one of its routers, exploit code is already public CVE-2026-86296
www.clubic.com · 20d ago · September 23rd, 2026
[VULN] D-Link alerts on a maximum severity flaw in one of its routers, exploit code is already public CVE-2026-86296
via Mastodon https://www.clubic.com/actualite-630922-d-link-alerte-sur-une-faille-de-gravite-maximale-dans-l-un-de-ses-routeurs-le-code-pour-l-exploiter-est-deja-public.html
-
update from nvd.nist.gov
D-Link warns of max severity Zero-Day Bug in DIR-822A Routers. Link warned customers of a maximum-severity vulnerability [CVE-2026-86296] wi
nvd.nist.gov · 15d ago · September 28th, 2026
Link warned customers of a maximum-severity vulnerability [CVE-2026-86296] wi
via Mastodon https://nvd.nist.gov/vuln/detail/cve-2026-86296