SECURITY researchers have disclosed two vulnerabilities affecting D-Link DIR-822A routers running firmware version A_101. CVE-2026-86296, rated 10.0 by CVSSv3, is a stack-based buffer overflow in the udhcpcd DHCP server. CVE-2026-86510, rated 9.9, is an out-of-bounds write in the L2TP control-message parser. D-Link confirmed that a public proof-of-concept has been reported, but the article says there is no confirmed exploitation in the wild.
CVE-2026-86296 can reportedly be triggered by an unauthenticated attacker on the local network sending a crafted DHCP message containing a malicious option 125 payload. The vulnerable code uses `strcpy` to copy length-delimited data into fixed 256-byte stack buffers, potentially causing a crash or arbitrary code execution. The L2TP flaw similarly involves malformed network packets and may compromise device integrity.
D-Link has not yet released patched firmware and is reviewing the affected scope and remediation options. Until further guidance is issued, administrators should isolate affected routers, disable remote management from external interfaces, restrict local network access to trusted devices and prevent guest networks from reaching administration ports.