D-Link confirms two critical, unpatched flaws in the DIR-822A router, with public exploits
On September 22, 2026, D-Link confirmed two critical flaws in the end-of-life DIR-822A router: a stack-based buffer overflow in the DHCP server (CVE-2026-86296, CVSS 10) and an out-of-bounds write in the L2TP parser (CVE-2026-86510, CVSS 9.9), both with public proof-of-concept code and no patch available. Replace or isolate these routers, and never expose them to the internet.
September 22, 2026. D-Link confirms two critical flaws in the DIR-822A, an end-of-life dual-band router. CVSS 10. The score of the first, a buffer overflow in the DHCP server. September 18, 2026. The date of advisory SAP10516, published with no patch. Why it matters: both flaws already have public proof-of-concept code, and no fix has been announced — an exposed consumer router becomes a way to compromise the entire local network.
The DIR-822A is a consumer Wi-Fi router that sold in volume years ago and is now out of production. That is exactly the profile botnets hunt for: still plugged in at homes and small businesses, rarely updated, often reachable from the internet. The two flaws D-Link just acknowledged hit two different network components of the same firmware.
A buffer overflow in the DHCP server
The first flaw, CVE-2026-86296, is a stack-based buffer overflow classified CWE-121. It sits in the strcpy function of udhcpcd/serverpacket.c — the heart of the embedded DHCP daemon (udhcpcd) — while parsing the option 125 field of the TR-111 protocol.
The mechanics are those of every stack overflow. The daemon reads incoming data — here a DHCP option sent by a client — and copies it into a fixed-size buffer with strcpy, without checking its length. When the input exceeds the capacity, the surplus bytes overwrite the stack and redirect execution flow. D-Link puts it plainly: a crafted request may cause data to exceed the available stack buffer, leading to memory corruption that can affect the device’s confidentiality, integrity, or availability.
The impact is serious. An unauthenticated attacker on the local network can send forged DHCP packets, trigger the overflow, and — per the advisory — either crash the DHCP daemon or achieve remote code execution. The NVD rates the flaw CVSS 10.0, the maximum score, with a network vector, no user interaction, and changed scope: the compromised router opens a path to the machines it serves.
An out-of-bounds write in the L2TP parser
The second flaw, CVE-2026-86510, is an out-of-bounds write classified CWE-787 in the tunnel_set_params function of the L2TP control message parser. It is triggered through the Host Name AVP field of an L2TP message and affects devices configured for L2TP or L2TPv6 WAN connectivity.
Unlike the first, it requires low privileges — the CVSS vector notes PR:L — but it is still rated CVSS 9.9, critical. An attacker who already holds limited access can manipulate input data to cause a write outside the buffer bounds and achieve arbitrary memory corruption. The same researcher published a separate proof of concept for this one.
Two public PoCs, zero patches
What turns these two flaws into an edge incident is the convergence of three signals. First, both proof-of-concept exploits are public, posted by the researcher who reported them to D-Link — enough to accelerate weaponization in the wild. Second, D-Link says it is still investigating both flaws and working on patches: as of today, no fix is available. Third, the device is an end-of-life consumer router, a category attackers exploit relentlessly.
CISA is watching the vendor closely. Its KEV catalog tracks 26 D-Link flaws that have been or still are exploited in the wild, two of which ransomware gangs have also abused. Obsolete D-Link routers regularly serve as fodder for DDoS botnets, as recent campaigns built on known flaws have shown.
What D-Link recommends
Until a patch arrives, D-Link’s guidance is threefold. Make sure the router is not exposed to the internet. Restrict remote management access (disable WAN administration). Limit administrative access to trusted systems and users through firewall or network-access controls.
These three measures neutralize most of the attack surface. The DHCP overflow plays out on the local network — an attacker without a foothold there cannot reach it. The L2TP write, for its part, requires prior privileges. Removing the device from the exposed surface and closing remote management cuts the most direct path to compromise.
# Check that a router is not exposing management ports to the internet
# (run from a machine outside the local network)
nmap -Pn -p 80,443,8080,23,22 <router-public-ip>
# From the LAN, identify the model via the router's HTTP banner
curl -sI http://192.168.0.1/ | grep -iE 'server|d-link|dir-822'The real fix, though, may never come for everyone. An end-of-life router rarely receives a fast patch, even when a CVSS 10 flaw with a public PoC hits it. The question is not “when to patch” but “when to replace”.
udhcpd, a daemon shared by thousands of devices
The DHCP flaw deserves a closer look, because it is not about one router. udhcpcd is the DHCP daemon of BusyBox, the embedded utility that ships in thousands of boxes, routers, and connected objects across the industry. A buffer overflow in udhcpcd is therefore not an isolated D-Link accident: it is a reminder that the DHCP stack — the one that hands out addresses, gateways, and DNS to every device on a network — is still written in C and exposed without authentication.
DHCP occupies a special place on a local network. It is what tells every machine which address to take, which gateway to use, and which DNS server to resolve names against. An attacker who can run code inside the router’s DHCP daemon can, in practice, redirect traffic, change the DNS it distributes, and intercept connections across the whole segment — exactly the position of control this stack overflow reaches.
TR-111 adds another layer. This remote-management protocol for carrier boxes, built for operator remote assistance, extends DHCP handling with rich options — including option 125 — that widen the input surface. The more formats a daemon parses, the more entry points it offers an overflow. It is a lesson the industry relearns with every flaw of this kind.
Verdict
CVE-2026-86296 and CVE-2026-86510 are not theoretical bugs: they are two critical flaws, rated 10 and 9.9, with public exploits and no patch, on an end-of-life router. If a DIR-822A is still in service, do not wait for a patch — replace it with a still-supported model, or at minimum take it off the internet, close remote management, and put it behind a firewall that allows only the bare minimum. If you manage a fleet of consumer routers, use this episode to audit your end-of-life devices: those are the ones that, for lack of a patch, become the entry point for tomorrow’s botnets.