D-Link warns of maximum-severity zero-day in DIR-822A routers

D-Link has warned customers of a maximum-severity vulnerability (CVE-2026-86296) in its legacy DIR-822A dual-band Wi-Fi routers. The flaw carries the highest severity rating, a proof-of-concept (PoC) exploit is already public, and no fix existed when the advisory was issued.

What the flaw does

The vulnerability stems from a stack-based buffer overflow and improper data handling in the DHCP server component, and it requires neither authentication nor user interaction. An attacker on the same local network, without valid credentials, can send crafted DHCP packets to trigger the overflow and either crash the DHCP daemon or achieve remote code execution.

According to D-Link, the problem lies in a call to the strcpy function in udhcpcd/serverpacket.c of the udhcpcd component: a specially crafted request causes data to exceed the available stack buffer. The resulting memory corruption could affect the device's confidentiality, integrity, or availability. The researcher who found and reported the bug published a PoC exploit, which may let attackers weaponize the flaw in the wild more quickly.

A second bug

D-Link is also investigating another vulnerability with public PoC code — a critical out-of-bounds write (CVE-2026-86510) in the L2TP control message parser, reported by the same researcher. An attacker with basic privileges could trigger memory corruption on devices configured to use L2TP or L2TPv6 WAN connectivity.

What to do

While patches are being prepared, the company advises making sure DIR-822A routers are not exposed online, restricting remote management, and limiting administrative access to trusted systems and users via firewall or network-access controls.

Though D-Link has not flagged these vulnerabilities as exploited in the wild, its devices are frequent targets: attackers often infect them with malware and enlist them into large-scale botnets used for DDoS attacks. CISA currently tracks 26 D-Link flaws that have been or are still exploited in attacks, two of which ransomware gangs have also abused.

Source: Bleeping Computer