Affected Systems

D-Link DIR-822A dual-band Wi-Fi routers (legacy models, all firmware versions). CVE-2026-86296 is a stack-based buffer overflow in the DHCP server component (udhcpcd/serverpacket.c). CVE-2026-86510 is a critical out-of-bounds write in the L2TP control message parser affecting devices using L2TP/L2TPv6 WAN connectivity.

Exploitation Status

Public proof-of-concept exploit code is available for CVE-2026-86296. No active exploitation confirmed yet, but D-Link devices are frequent botnet targets. CVE-2026-86510 also has public PoC. CISA tracks 26 D-Link vulnerabilities exploited in the wild, including by ransomware gangs.

Business Impact

Unauthenticated attackers on the same local network can exploit CVE-2026-86296 to crash the DHCP daemon or achieve remote code execution. No patch is available and D-Link is still investigating. Devices are legacy models, likely end-of-life. Risk of botnet recruitment for DDoS attacks is high. Organizations using DIR-822A routers face immediate compromise risk with no vendor fix timeline.

Urgency

🔴 Immediate

Recommended Actions

  • Identify and inventory all D-Link DIR-822A routers in your environment immediately
  • Ensure DIR-822A routers are not exposed to the internet; verify no remote management is enabled
  • Restrict administrative access to DIR-822A devices to trusted IP addresses only via firewall or ACLs
  • Isolate DIR-822A routers from critical network segments; consider placing on separate VLAN with strict egress filtering
  • Plan immediate replacement of DIR-822A routers with supported, patched hardware from current vendor lineup