Loading story…
D-Link is investigating two critical flaws reported in DIR-822A routers running firmware A_101. CVE-2026-86296 is an unauthenticated, network-reachable stack-based buffer overflow in the udhcpcd component, rated CVSS 10.0, that could enable denial of service or remote code execution. A public proof-of-concept exploit has reportedly been released.
The second issue, CVE-2026-86510, is an out-of-bounds write in the L2TP Control Message Parser, rated 9.9 under CVSS v3.1 and requiring low privileges but no user interaction; public exploit code has also reportedly been released. D-Link has not confirmed the complete affected hardware-revision or regional scope, nor whether remediation is available. Organizations should verify deployed router models and firmware, disable unnecessary remote management, restrict administrative access, and monitor regional D-Link support channels for updates.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Public proof-of-concept exploits were reportedly released for CVE-2026-86296 and CVE-2026-86510. CVE-2026-86296 may enable unauthenticated remote disruption or code execution, while CVE-2026-86510 can trigger memory corruption through crafted L2TP control messages.
D-Link Systems disclosed it is investigating CVE-2026-86296, an unauthenticated network-reachable stack buffer overflow in udhcpcd affecting reported DIR-822A firmware A_101, and CVE-2026-86510, an L2TP control-message parser out-of-bounds write in the same reported firmware. The flaws are scored CVSS 10.0 and 9.9 (v3.1), respectively; D-Link had not confirmed the complete affected hardware, regional scope, or remediation status.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-7288** and **CVE-2026-7289**, were disclosed in **D-Link DIR-825M** firmware **1.1.12**, exposing the router to remotely exploitable buffer overflows. The flaws affect the `/boafrm/formVpnConfigSetup` and `/boafrm/formWanConfigSetup` components, where improper handling of the `submit-url` argument in functions `sub_4151FC` and `sub_414BA8` can trigger memory corruption. Both CVEs were classified under **CWE-119** and **CWE-120** and were assigned high-impact ratings across confidentiality, integrity, and availability. Public exploit information is already available, and one entry notes exploitation is possible with low attack complexity and low privileges, raising the risk of real-world abuse against exposed or improperly managed devices.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2026-5983** and **CVE-2026-5984**, were disclosed in the unsupported **D-Link DIR-605L** router running firmware `2.13B01`. Both flaws are remote **buffer overflows** tied to POST request handlers exposed under `/goform/`, with the `curTime` argument identified as the attack vector. **CVE-2026-5983** affects the `formSetDDNS` function in `/goform/formSetDDNS`, while **CVE-2026-5984** affects the `formSetLog` function in `/goform/formSetLog`. The vulnerabilities are classified under **CWE-119** and **CWE-120** and carry high-impact CVSS assessments affecting confidentiality, integrity, and availability. The disclosures indicate that remote exploitation is possible and that a **public exploit** is available or has been disclosed, increasing the risk to internet-exposed devices. Because the DIR-605L is no longer supported by D-Link, organizations and users still operating the router face elevated exposure without an expected vendor fix.
Jun 29, 2026
D-Link DWR-M961 routers, hardware version `C1`, were found to contain **five critical vulnerabilities** that allow remote, unauthenticated attackers to execute arbitrary commands as root or crash the device. The issues affect firmware versions earlier than `1.1.5_C1_202607071108` and include three command injection flaws—`CVE-2026-71944` in `/boafrm/formLtefotaUpgradeQuectel` via `fota_url`, `CVE-2026-71955` in `/boafrm/formWsc` via fields including `localPin`, `targetAPSsid`, `peerPin`, and `peerRptPin`, and `CVE-2026-71956` in `app.cgi` via `netDig.ping.dst`—as well as two buffer overflows: `CVE-2026-71957` in `app.cgi` via `netAcc.addlist[].name` and `CVE-2026-71958` in `quicksetup.cgi` via `test4`, `ssid2`, and `username`. All five bugs carry a **CVSS 3.1 score of 9.8** and were classified under `CWE-78` for command injection or `CWE-120` for buffer overflow, reflecting high impact on confidentiality, integrity, and availability. Public reporting credited researchers **Jincheng Wang, Le Yu, and Xiapu Luo** with the discoveries, while D-Link released firmware `1.1.5_C1_202607071108` to address the flaws. Reporting at the time of disclosure said no active exploitation had been observed, and the vulnerabilities were also highlighted by regional CERT reporting on D-Link products.
Aug 16, 2026