Loading vulnerability…
CVE-2026-100740 is a remotely exploitable out-of-bounds write in the L2TP Control Channel Parser of D-Link DIR-895L firmware A1_102b07. The flaw is in the tunnel_set_params function. Manipulation of L2TP control-channel data can cause a write outside the intended memory-buffer bounds. The vulnerability is classified as CWE-787 (Out-of-bounds Write); it is also associated with CWE-119.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This six-file Python repository is a standalone PoC for CVE-2026-100740 affecting D-Link DIR-895L firmware A1_102b07. Its sole code entry point, poc.py, uses requests/urllib3 for HTTP(S) fingerprinting and Python sockets for L2TP/UDP interaction. It normalizes a supplied URL/IP or a target list, requests common management paths, identifies D-Link and DIR-895L markers, extracts firmware strings, and checks whether the identified firmware is A1_102b07. It also assesses UDP port 1701 and can send an optional minimal L2TP probe. In exploit mode, the dangerous action is gated by --oob-send and transmits a crafted L2TP SCCRQ carrying a 127-byte Host Name AVP, intended to trigger an off-by-one/adjacent-memory NUL write in tunnel_set_params(). The tool supports concurrent list scanning, proxies, timeouts, JSONL reporting, and a hit list. README.md documents the vulnerability and safety caveat; requirements.txt lists requests and urllib3; targets.example.txt contains a local-router example. The code is not part of a recognized exploit framework and does not contain an RCE or shell payload.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Critical remote out-of-bounds write vulnerability in the L2TP Control Channel Parser of D-Link DIR-895L firmware A1_102b07. A crafted L2TP packet, including manipulation of a Host Name AVP, can corrupt memory and potentially enable remote code execution and full device compromise.
A remotely exploitable out-of-bounds write vulnerability in the L2TP Control Channel Parser, specifically the tunnel_set_params function in tunnel.c, on D-Link DIR-895L firmware A1_102b07. The listed CVSS vectors indicate low attack complexity, required low privileges, no user interaction, and high impact to confidentiality, integrity, and availability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.