D-Link warns of max severity zero-day bug in DIR-822A routers
Read original article ↗AI Summary
D-Link has issued a warning about a maximum-severity zero-day vulnerability, CVE-2026-86296, affecting legacy DIR-822A Wi-Fi routers. The flaw is a stack-based buffer overflow in the DHCP server component (udhcpcd/serverpacket.c) that can be exploited without authentication or user interaction by sending crafted DHCP packets. Proof-of-concept exploit code has been publicly released, increasing the risk of weaponization. D-Link is also investigating a second critical vulnerability, CVE-2026-86510, an out-of-bounds write in the L2TP control message parser, which could allow arbitrary memory corruption on devices using L2TP or L2TPv6 WAN connectivity.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.