Loading story…
A critical out-of-bounds write in the L2TP control-channel parser of D-Link DIR-895L firmware A1_102b07 enables a low-privileged remote attacker to send a crafted L2TP packet with manipulated Host Name AVP data, corrupt memory in tunnel_set_params, and potentially execute code on the router. Tracked as CVE-2026-100740, the flaw is rated CVSS 9.9 and has a public proof of concept; no confirmed patch, mitigation, or CISA Known Exploited Vulnerabilities listing was reported.
A closely related flaw, CVE-2026-96891, affects the rp-l2tp implementation in D-Link DIR-825 firmware 3.00b32, where crafted peer_hostname input can trigger memory corruption and potentially cause denial of service or code execution. The DIR-825 is end of life with no listed fixed firmware, while DIR-895L operators should disable L2TP where possible, remove affected routers from Internet exposure, isolate them, and prioritize replacement; no confirmed in-the-wild exploitation was reported for either issue.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
cna@vuldb.com received the CVE entry for an out-of-bounds write in the D-Link DIR-895L A1_102b07 L2TP Control Channel Parser. The issue affects tunnel_set_params in tunnel.c, and the record states that a public exploit is available.
The CVE record for CVE-2026-96891 was published. The affected DIR-825 hardware is end-of-life, and no fixed firmware was listed.
A critical out-of-bounds write vulnerability in the rp-l2tp component's tunnel_set_params function was publicly disclosed affecting D-Link DIR-825 firmware 3.00b32. Crafted peer_hostname input can cause memory corruption, potentially resulting in denial of service or code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecvefeed.io
Open sourcethreataft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
D-Link is investigating two critical flaws reported in `DIR-822A` routers running firmware `A_101`. `CVE-2026-86296` is an unauthenticated, network-reachable stack-based buffer overflow in the `udhcpcd` component, rated CVSS 10.0, that could enable denial of service or remote code execution. A public proof-of-concept exploit has reportedly been released. The second issue, `CVE-2026-86510`, is an out-of-bounds write in the L2TP Control Message Parser, rated 9.9 under CVSS v3.1 and requiring low privileges but no user interaction; public exploit code has also reportedly been released. D-Link has not confirmed the complete affected hardware-revision or regional scope, nor whether remediation is available. Organizations should verify deployed router models and firmware, disable unnecessary remote management, restrict administrative access, and monitor regional D-Link support channels for updates.
Sep 24, 2026
Two high-severity vulnerabilities, **CVE-2026-7288** and **CVE-2026-7289**, were disclosed in **D-Link DIR-825M** firmware **1.1.12**, exposing the router to remotely exploitable buffer overflows. The flaws affect the `/boafrm/formVpnConfigSetup` and `/boafrm/formWanConfigSetup` components, where improper handling of the `submit-url` argument in functions `sub_4151FC` and `sub_414BA8` can trigger memory corruption. Both CVEs were classified under **CWE-119** and **CWE-120** and were assigned high-impact ratings across confidentiality, integrity, and availability. Public exploit information is already available, and one entry notes exploitation is possible with low attack complexity and low privileges, raising the risk of real-world abuse against exposed or improperly managed devices.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2026-5983** and **CVE-2026-5984**, were disclosed in the unsupported **D-Link DIR-605L** router running firmware `2.13B01`. Both flaws are remote **buffer overflows** tied to POST request handlers exposed under `/goform/`, with the `curTime` argument identified as the attack vector. **CVE-2026-5983** affects the `formSetDDNS` function in `/goform/formSetDDNS`, while **CVE-2026-5984** affects the `formSetLog` function in `/goform/formSetLog`. The vulnerabilities are classified under **CWE-119** and **CWE-120** and carry high-impact CVSS assessments affecting confidentiality, integrity, and availability. The disclosures indicate that remote exploitation is possible and that a **public exploit** is available or has been disclosed, increasing the risk to internet-exposed devices. Because the DIR-605L is no longer supported by D-Link, organizations and users still operating the router face elevated exposure without an expected vendor fix.
Jun 29, 2026