Cybersecurity
D-Link warns of DIR-822A router flaws
D-Link said a buffer overflow in the DIR-822A DHCP server and a second parser flaw were under investigation, with public proof-of-concept code already available and patches still pending.
- D-Link said CVE-2026-86296 in DIR-822A routers came from a stack-based buffer overflow and improper data handling in the DHCP server component.
- The company said crafted DHCP packets from the same local network could trigger the flaw without authentication or user interaction and might crash the DHCP daemon or allow remote code execution.
- D-Link said the researcher who found the issue had published proof-of-concept exploit code, and it was also investigating CVE-2026-86510 in the L2TP control message parser.
- The company said it had not flagged either issue as exploited and told customers to keep the routers off the internet, restrict remote management, and limit administrative access to trusted systems.
- The Cybersecurity and Infrastructure Security Agency tracks 26 D-Link flaws that have been or are still exploited in attacks, and two have also been abused by ransomware gangs.
D-Link said CVE-2026-86296 in the DIR-822A involved a stack-based buffer overflow and improper data handling in the DHCP server component. It said the issue could be triggered by crafted DHCP packets from the same local network.
According to the company, the flaw did not require authentication or user interaction. It said the effect could range from a crash of the DHCP daemon to remote code execution on the device.
D-Link also said the researcher who found the problem had published proof-of-concept exploit code. The company said that could help attackers turn the vulnerability into working attacks more quickly.
The company said it was also investigating CVE-2026-86510, a critical out-of-bounds write in the L2TP control message parser. It said devices using L2TP or L2TPv6 WAN connectivity could be affected, and that manipulating input could lead to arbitrary memory corruption.
D-Link said it had not marked either issue as exploited in attacks and was working on patches. It advised owners to keep the routers off the internet, restrict remote management, and limit administrative access to trusted systems and users.
Named in this story
Companies
- D-Link
- warned customers about flaws in its DIR-822A routers
Governments and agencies
- Cybersecurity and Infrastructure Security Agency
- was cited as tracking D-Link flaws exploited in attacks
Products and systems
- DIR-822A dual-band Wi-Fi routers
- were the affected router model
- udhcpcd
- contained the DHCP server code implicated in the first flaw
How the source tells it
The piece reads like a security advisory, with a mild urgency cue from public exploit code and temporary mitigation advice.
- urgency The article stressed public proof-of-concept code, no patch yet, and immediate hardening advice.
- threat framing It linked the flaws to remote code execution, memory corruption, and possible botnet use.