D-Link Systems has recently identified a significant security flaw in its DIR-822A router, recorded under CVE-2026-86296. This vulnerability has been assigned the highest possible CVSS score of 10.0, indicating that remote attackers could potentially exploit it without requiring authentication or user interaction.
Details of the Vulnerability
The flaw is located in the udhcpcd component of the DIR-822A firmware version A_101. Specifically, it involves a stack-based buffer overflow in the udhcpcd/serverpacket.c file, where the unsafe use of the strcpy function allows attacker-controlled data to be copied into a fixed-size stack buffer.
When this buffer is overfilled with malicious input, it can lead to the overwriting of adjacent memory locations, resulting in device crashes, service disruption, or unauthorized code execution on the router.
D-Link’s Response and Recommendations
D-Link is actively investigating the vulnerability but has yet to confirm which hardware revisions or regional products are affected, as well as the status of any firmware patches. The CVSS vector suggests that the attack can be executed over a network with minimal complexity, requiring no user credentials or interaction.
Organizations using the DIR-822A model should prioritize addressing this vulnerability. D-Link advises users to confirm their router’s model, hardware revision, and firmware version, avoid exposing router administrative interfaces online, disable remote management when unnecessary, and limit administrative access to trusted devices.
Additional Vulnerability and Security Measures
A secondary critical flaw, CVE-2026-86510, also affects the DIR-822A A_101 version, involving an out-of-bounds write in the tunnel_set_params function of the L2TP Control Message Parser. This flaw possesses a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4.
Exploiting CVE-2026-86510 requires low privilege levels but no user interaction, potentially allowing memory corruption through crafted L2TP control messages. D-Link has emphasized the importance of checking regional support portals for updates and cautioned that installing firmware intended for different hardware revisions could harm the device.
For enhanced security, users are encouraged to monitor D-Link’s support channels for any firmware releases or guidance and to integrate threat intelligence tools to streamline their SOC operations.
