Critical CVSS 10.0 Flaw in D-Link DIR-822A Router Allows Unauthenticated Remote Code Execution
A critical stack-based buffer overflow vulnerability (CVE-2026-86296) in D-Link DIR-822A routers, rated CVSS 10.0, allows unauthenticated remote attackers to execute code.
D-Link Systems is currently investigating a severe security vulnerability affecting its DIR-822A routers, identified as CVE-2026-86296. This flaw has been assigned the highest possible CVSS severity score of 10.0, indicating a critical risk to affected devices. The vulnerability could permit remote attackers to compromise the routers without requiring any form of authentication or user interaction, posing a significant threat to network security.
The vulnerability resides within the udhcpcd component of the DIR-822A firmware version A_101. Specifically, it is a stack-based buffer overflow located in the udhcpcd/serverpacket.c file. The issue stems from the use of the insecure strcpy function, which copies data controlled by an attacker into a fixed-size buffer on the stack. If the input data exceeds the buffer's capacity, it can overwrite adjacent memory regions. This overflow condition can lead to device instability, service disruptions, or, more critically, enable an attacker to execute arbitrary unauthorized code on the router.
D-Link has stated that it is actively investigating the vulnerability. However, the company has not yet provided details regarding the specific hardware revisions, regional product availability, or the status of any firmware remediation efforts. The vulnerability is categorized under CWE-121 (Stack-Based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The CVSS v3.1 vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R, highlights that the attack can be launched remotely with low complexity, requiring no credentials or user interaction, and can impact confidentiality, integrity, and availability.
The potential impact of successful exploitation is substantial, particularly for routers that are directly exposed to the internet. The ability for an attacker to gain control of a router can lead to widespread network compromise, data interception, or the use of the device in further malicious activities. Adding to the urgency, a public proof-of-concept exploit for CVE-2026-86296 has reportedly been released. Such public disclosures often accelerate the exploitation of vulnerabilities as threat actors adapt the provided code into their attack toolkits.
In addition to CVE-2026-86296, D-Link has also confirmed the existence of a second critical vulnerability impacting the same DIR-822A A_101 firmware. This flaw, tracked as CVE-2026-86510, is an out-of-bounds write vulnerability within the tunnel_set_params function of the L2TP Control Message Parser. It carries a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4. While exploitation requires low privileges, it does not necessitate user interaction and can lead to memory corruption through specially crafted L2TP control messages. A public proof-of-concept exploit has also been reported for this vulnerability.
Given the critical nature of these vulnerabilities and the availability of public exploits, organizations utilizing D-Link DIR-822A routers should consider this an urgent exposure management concern. D-Link advises users to verify their specific router model, hardware revision, and firmware version. They also recommend best practices such as disabling remote management features when not essential and restricting administrative access to trusted internal systems. Customers are urged to monitor their regional D-Link support portals for official firmware updates and security guidance, as firmware is hardware-revision specific and incorrect installation can damage the device.
This incident underscores the persistent threat posed by critical vulnerabilities in widely used consumer and small business networking equipment. The CVSS 10.0 rating for CVE-2026-86296 signifies a complete compromise of security, making it imperative for users to stay informed and apply patches as soon as they become available. The dual discovery of these critical flaws highlights the importance of ongoing security research and vendor diligence in addressing potential attack vectors.