D-Link DIR-895L L2TP Parser Out-of-Bounds Write (CVE-2026-100740)

Executive Summary

A critical out-of-bounds write vulnerability (CVE-2026-100740) has been disclosed in the D-Link DIR-895L wireless router, affecting firmware version A1_102b07. The flaw lives in tunnel_set_params() in tunnel.c, part of the device's L2TP Control Channel Parser. The function fails to properly bound a Host Name AVP (Attribute-Value Pair) before copying it into a fixed-size buffer, and a public proof-of-concept exploit is already available.

CVSS Score: 9.9 (Critical) CWE: CWE-787 (Out-of-Bounds Write)

Vulnerability Overview

Affected Products

The DIR-895L is a high-end AC5300 tri-band router that D-Link no longer actively maintains under a current security-support cycle, which raises the likelihood that this flaw will go unpatched.

Technical Details

Root Cause

The parser clamps the incoming Host Name AVP length to 127 bytes but then writes a NUL terminator at peer_hostname[len+1] into a buffer that is only 128 bytes long. When the clamped length reaches its maximum, the terminator write lands one byte past the end of the buffer, corrupting adjacent memory. Because the check that clamps the length runs before the terminator is written — rather than accounting for the terminator's own space — the off-by-one slips through on every maximally-sized hostname.

Attack Chain

1. Attacker crafts a malicious L2TP control message (or spoofs/hijacks
   an upstream L2TP peer, e.g. an ISP-facing WAN link) containing a
   Host Name AVP at or near the 127-byte clamp boundary
 
2. tunnel_set_params() in tunnel.c copies the AVP into peer_hostname[128]
 
3. The NUL terminator is written at peer_hostname[len+1], one byte
   beyond the buffer when len is clamped to its maximum
 
4. Adjacent heap/stack memory is corrupted (out-of-bounds write)
 
5. Depending on memory layout, this yields denial-of-service (crash)
   or, when chained with further memory-layout manipulation, potential
   arbitrary code execution

The publicly available PoC (murrez/CVE-2026-100740) demonstrates the memory-corruption primitive but — per independent analysis — does not ship a complete remote code execution chain. Treat the flaw as a confirmed crash/DoS primitive with a credible path to RCE, not yet a turnkey exploit.

Why CVSS 9.9?

The vector reflects no authentication, no user interaction, and network-level reachability over L2TP (UDP/1701) — a protocol the DIR-895L can process as a WAN-side L2TP client to an ISP tunnel server, meaning a malicious or spoofed peer upstream of the router can potentially trigger it without the victim taking any action.

Impact Assessment

Recommendations

Immediate Actions

1. Disable WAN-side L2TP client functionality on the DIR-895L unless it is actively required for your ISP connection.
2. Check D-Link's support portal for a firmware update addressing CVE-2026-100740; apply immediately if one is released.
3. If no patch is available, place the device behind a separate router/firewall and restrict inbound UDP/1701 to only the trusted ISP tunnel endpoint.
4. Monitor for firmware updates — given D-Link's mixed patching record on older high-end models, do not assume a fix is forthcoming.

Network-Level Mitigations

- Restrict UDP/1701 (L2TP) traffic to known-good, authenticated peers only
- Where the router is not used as an L2TP client, disable the
  L2TP tunnel feature entirely in the admin interface
- Deploy IDS/IPS signatures for oversized or malformed L2TP
  Host Name AVPs
- Monitor for unexpected router reboots or L2TP service crashes,
  which may indicate exploitation attempts

End-of-Life Considerations

If D-Link does not release a fix for firmware A1_102b07:

1. Replace the DIR-895L with a currently supported router
2. Use an upstream firewall/gateway to filter L2TP traffic
   reaching the device
3. Segment the router onto an isolated VLAN pending replacement

Detection Indicators

References

• NIST NVD — CVE-2026-100740
• VulDB — CVE-2026-100740
• TheHackerWire — D-Link DIR-895L L2TP Out-of-Bounds Write Enables Remote Code Execution
• CWE-787: Out-of-Bounds Write