Security 2 publishers3 min readPublished September 23, 2026 at 12:49 AM PDT

Public exploit code circulates for an unpatched 10.0 DHCP overflow in D-Link's DIR-822A

VulDB scored CVE-2026-86296 at 10.0 because a crafted DHCP request reaches the DIR-822A's udhcpcd with no credentials and no user interaction, while D-Link is still working out which hardware revisions are affected.

The Watch · Security desk

Illustration accompanying Public exploit code circulates for an unpatched 10.0 DHCP overflow in D-Link's DIR-822A

What happened

CVE-2026-86296 is a stack-based buffer overflow in a strcpy call in udhcpcd/serverpacket.c on the D-Link DIR-822A, exploitable remotely with no authentication and no user interaction, with a public proof-of-concept reported.
VulDB, the CNA that assigned the CVE, rated it 10.0 (Critical) on both CVSS v3.1 and CVSS v4.0, the top of both scales, and D-Link's advisory reprints those scores.
The same researcher reported a second DIR-822A flaw, CVE-2026-86510, a critical out-of-bounds write in the L2TP control message parser that also has public exploit code.

Compiled by The WatchSomething wrong?How this is made

Why it matters

contradiction D-Link's containment advice covers internet exposure and remote management, while the attack BleepingComputer describes arrives from an unauthenticated client on the LAN, so the published mitigations leave that path open.
decision D-Link has said it will issue retirement and replacement guidance if the DIR-822A proves to be out of support, so owners are weighing a hardware purchase while they wait for a verdict on firmware.
exposure Any DIR-822A sharing a network with untrusted clients is reachable using code anyone can download, and D-Link devices in that state are the stock that DDoS botnet operators harvest.

The DHCP server on the DIR-822A is udhcpcd, and the overflow sits in serverpacket.c, in a strcpy call that copies data out of a request without bounding it ^[1]. D-Link put the outcome in its own words on Friday: "A specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function. Successful exploitation may cause memory corruption and could allow an attacker to affect the device's confidentiality, integrity, or availability," the company said ^[12]. The CVE record is shorter: "The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized" ^[11].

Where the packet comes from decides what defenders can do. VulDB's vector says AV:N ^[4]. BleepingComputer's description is narrower: an attacker with no credentials on the same local network sends crafted DHCP packets and either kills the daemon or gets code execution ^[10]. D-Link's recommended actions are keeping the device off the public internet where it is not needed, restricting remote management, limiting administrative access with firewall or network-access controls, watching the regional support site, and flashing only firmware built for the exact hardware revision ^[8]. Each of those bounds the WAN side or the admin interface. A DHCP request from a laptop already on the LAN passes through all of them ^[21]. Containment for that path means keeping untrusted clients, guest wireless and whatever a visitor plugs into a wall port, off the same broadcast domain as the router's DHCP server ^[21].

The same researcher reported a second bug. CVE-2026-86510 is an out-of-bounds write in tunnel_set_params in the L2TP control message parser, also with public exploit code ^[13], and it applies to devices configured for L2TP or L2TPv6 WAN connectivity ^[14]. It scores 9.9 on CVSS v3.1 against the DHCP bug's 10.0 ^[15]^[3]. The two v3.1 vectors differ in one metric: PR:N on the DHCP overflow, PR:L on the L2TP write ^[20].

Anyone triaging from D-Link's page should check which CVE they are reading. The affected-product block for DIR-822A version A_101 lists the component as tunnel_set_params of the L2TP Control Message Parser ^[16], and the technical section carries both score pairs, 10.0/10.0 and 9.9/9.4 ^[3]^[15]. The product status line is "Under Investigation" ^[5], and D-Link is still verifying hardware revisions, regional scope, lifecycle status, and whether an updated firmware release is available or appropriate ^[6]. BleepingComputer reports the company is working on security patches ^[22]. If the DIR-822A turns out to be past support, D-Link says it will issue retirement and replacement guidance ^[7].

Neither flaw has been flagged as exploited in attacks ^[17]. CISA tracks 26 D-Link flaws that have been or are still exploited, two of them also abused by ransomware gangs ^[18], and vulnerable D-Link devices are routinely pulled into large-scale DDoS botnets ^[19]. The report came from a researcher D-Link credits as tian, through VulDB as CNA, filed as VDB-399458 ^[9].

What to watch

A D-Link firmware release or a retirement notice for the DIR-822A, with the affected hardware revision list attached.
Either CVE appearing in CISA's tracking of exploited D-Link flaws, which would move it from public PoC to confirmed in-the-wild use.
Crafted DHCP traffic matching the published PoC turning up in the botnet loaders that already scan for D-Link gear.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[2]
According to the published CVE information, CVE-2026-86296 may be exploited remotely without authentication or user interaction, and a public proof-of-concept has been reported.
ReportedSupported3 sources— sign in to open View cited source
[11]
"The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized."
ReportedSupportedSource: Published CVE record text, quoted by BleepingComputer3 sources— sign in to open View cited source
[1]
CVE-2026-86296 affects the D-Link DIR-822A and is a stack-based buffer overflow associated with the use of the strcpy function in udhcpcd/serverpacket.c, in the device's udhcpcd component.
ReportedSupported2 sources— sign in to open View cited source
[3]
The CVE Numbering Authority assigned CVE-2026-86296 a CVSS v3.1 score of 10.0 (Critical) and a CVSS v4.0 score of 10.0 (Critical).
ReportedSupported2 sources— sign in to open View cited source
[4]
The published CVSS v3.1 vector for the 10.0 score is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R.
ReportedSupported2 sources— sign in to open View cited source
[5]
The advisory identifies the affected product as DIR-822A, reported version A_101, with status "Under Investigation".
ReportedSupported2 sources— sign in to open View cited source
[6]
D-Link says it is continuing to verify the applicable hardware revision or revisions, the geographic or regional product scope, the product lifecycle status, and whether an updated firmware release is available or appropriate.
ReportedSupported2 sources— sign in to open View cited source
[8]
D-Link's recommended customer actions are to ensure the device is not unnecessarily exposed to the public Internet, restrict remote management access unless required, use firewall or network-access controls to limit administrative access to trusted systems and users, monitor the applicable regional support site for updated firmware or guidance, and install only firmware intended for the exact product model and hardware revision.
ReportedSupported2 sources— sign in to open View cited source
[10]
Attackers without valid credentials on the same local network can send crafted DHCP packets to the device, trigger the overflow, and potentially crash the DHCP daemon or achieve remote code execution on targeted devices.
ReportedSupported2 sources— sign in to open View cited source
[12]
"A specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function. Successful exploitation may cause memory corruption and could allow an attacker to affect the device's confidentiality, integrity, or availability," the company explained in a Friday advisory.
ReportedSupportedSource: D-Link advisory, quoted by BleepingComputer2 sources— sign in to open View cited source
[13]
D-Link is also investigating a second vulnerability with public PoC exploit code affecting DIR-822A routers, a critical out-of-bounds write (CVE-2026-86510) in the L2TP control message parser, reported by the same researcher.
ReportedSupported2 sources— sign in to open View cited source
[14]
Threat actors with basic privileges may exploit CVE-2026-86510 to trigger arbitrary memory corruption via an out-of-bounds write against devices configured to use L2TP or L2TPv6 WAN connectivity.
ReportedSupported2 sources— sign in to open View cited source
[15]
The advisory also publishes a CVSS v3.1 score of 9.9 (Critical) and a CVSS v4.0 score of 9.4 (Critical) for the record covering the tunnel_set_params out-of-bounds write, with v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R.
ReportedSupported2 sources— sign in to open View cited source
[16]
In the advisory's affected-product block for DIR-822A reported version A_101, the vulnerability type is given as Out-of-Bounds Write and the component as "function tunnel_set_params of the component L2TP Control Message Parser".
ReportedSupported2 sources— sign in to open View cited source
[22]
BleepingComputer reports that D-Link is still investigating the two flaws and working on security patches.
ReportedSupported2 sources— sign in to open View cited source
[7]
D-Link says that if it determines the affected product is no longer supported, it will provide appropriate product retirement and replacement guidance.
ReportedSupportedView cited source
[9]
D-Link acknowledges security researcher tian for the report; the CVE Numbering Authority is VulDB and the VulDB reference is VDB-399458.
ReportedSupportedView cited source
[17]
D-Link has not flagged these vulnerabilities as exploited in attacks.
ReportedSupportedView cited source
[18]
CISA tracks 26 D-Link security flaws that have been or are still exploited in attacks, two of which ransomware gangs have also abused.
ReportedSupportedView cited source
[19]
Attackers often target vulnerable D-Link devices to build large-scale botnets used for distributed denial-of-service attacks.
ReportedSupportedView cited source
[21]
None of D-Link's listed mitigations restricts a crafted DHCP request sent by an unauthenticated client already on the local network: each one bounds internet exposure, remote management, or administrative access, so the only control that touches the described path is separating untrusted clients from the DHCP server's broadcast domain.
DerivedSupported2 sources— sign in to open
[20]
The two published CVSS v3.1 vectors differ in a single metric, privileges required: PR:N on the udhcpcd overflow scored 10.0 and PR:L on the L2TP out-of-bounds write scored 9.9.
DerivedSupported1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

bleepingcomputer.com
1 article · September 22, 2026
D-Link warns of max severity zero-day bug in DIR-822A routers
supportannouncement.us.dlink.com
1 article · September 22, 2026
D-Link CVE-2026-86296

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Both accounts name the code. The overflow is a strcpy in udhcpcd/serverpacket.c; the second flaw is an out-of-bounds write in tunnel_set_params inside the L2TP control message parser. That is enough to grep a firmware tree for the same pattern, and it is most of what a developer gets here. D-Link says it is still verifying which hardware revisions carry the affected build, so there is no way yet to tell which shipped images are in scope. The researcher's proof-of-concept is described as public by the vendor and by BleepingComputer, and neither links to it.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence72

0100

Vendor-primary, exploit unverified

The technical core is first-hand. D-Link's advisory names the component, the file, the function and both CVSS vectors, and publishes the VulDB record number next to them, so the 10.0 can be recomputed from the vector rather than taken on trust. Neither account verified the exploit itself; both report a public proof-of-concept because the vendor and VulDB say there is one. The affected-product line still reads "Under Investigation." Even the scope, then, is a provisional vendor answer.

Adoption30

0100

Exploit code public, real-world use unconfirmed

Exploit code is out and there is no firmware to install, which is the worst half of the picture. The other half is empty: neither source reports the flaw being used against anyone, D-Link has not flagged it as exploited, and the 26 exploited D-Link flaws CISA tracks are earlier ones. Neither account says how many DIR-822A routers run version A_101, so the exposed population is unmeasured.

Hype gap+18

−100 understated0 aligned+100 overstated

Score fits, "zero-day" overreaches

"Max severity" is straight from the record, since VulDB really did publish 10.0 under both CVSS versions. "Zero-day" carries an implication of active attack that BleepingComputer's own text contradicts two paragraphs later. The larger stretch sits inside the vector: PR:N with AV:N and S:C scores an unauthenticated attacker at network distance, while the exploitation both accounts describe involves DHCP traffic on the local segment.

Incentives55

0100

Vendor and numbering authority both interested

The vendor wrote one of the two accounts, and its shape matters: an advisory that leaves hardware revision, region and lifecycle status open also defers the question of whether a fix is owed, with retirement guidance held in reserve. The score comes from VulDB, which is both the numbering authority for this CVE and the database whose record, VDB-399458, the advisory cites. BleepingComputer's page carries a promotional pitch for a paid security summit beneath the story.

Confidence70

0100

Solid on detail, unclear on reach

Two sources, one of them the vendor, agree on every technical particular, and the score itself can be recomputed from the CVSS vector. Where I would hold back is reach: the maximum score assumes an attacker at network distance, the exploitation described assumes one already on the LAN, and nothing in either account settles which it is. Which hardware revisions ship the affected build is also still open.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
Admin credentials are the only gate on D-Link's unfixed R95 command injection
1 publisher
build
A UDP packet is now enough: IKEEXT RCE moves from patch queue to fire drill
1 publisher
security
Scattered Spider talks help desks into moving MFA onto attacker-controlled devices
1 publisher
security
Signed int arithmetic in libde265 shrinks a 4 GB plane allocation to 1,040 bytes before the fill
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Perspective Coverage

Reality