No Patch, Public Exploit Code, Maximum Severity
D-Link has warned customers of a maximum-severity vulnerability affecting legacy DIR-822A dual-band Wi-Fi routers — with public proof-of-concept exploit code already circulating and no patch available.
Vulnerability Summary
| Field | Details |
|---|---|
| Primary CVE | CVE-2026-86296 |
| Secondary CVE | CVE-2026-86510 |
| Affected Device | D-Link DIR-822A (legacy, dual-band Wi-Fi router) |
| Exploit Code | Publicly available (both flaws) |
| Patch Status | None — D-Link investigating |
CVE-2026-86296 — DHCP Server Stack Overflow
The primary flaw is a stack-based buffer overflow in the router's DHCP server component. It stems from the strcpy function in udhcpcd/serverpacket.c, where attacker-controlled data can exceed the available stack buffer, corrupting memory and potentially enabling remote code execution.
CVE-2026-86510 — L2TP Parser Out-of-Bounds Write
A secondary out-of-bounds write vulnerability exists in the router's L2TP control message parser, affecting devices configured for L2TP or L2TPv6 WAN connectivity.
Why This Matters
The DIR-822A is a legacy product, meaning D-Link may be slower — or may decline entirely — to ship a fix depending on the device's end-of-life status. With public PoC code already available for both bugs, opportunistic scanning and exploitation attempts against internet-exposed devices are likely to follow quickly.
Mitigation
Since no patch currently exists, D-Link and researchers recommend:
- Do not expose the router's management interface to the internet
- Restrict remote management access entirely where possible
- Limit administrative access via firewall rules to trusted internal systems only
- Consider replacing end-of-life hardware that no longer receives regular security updates
- Disable L2TP WAN configuration if not actively required, to reduce exposure to CVE-2026-86510