CVE-2026-96891: D-Link DIR-825 rp-l2tp Out-of-Bounds Write Enables Remote Compromise

Executive Summary

CVE-2026-96891 is a critical out-of-bounds write vulnerability in the D-Link DIR-825 wireless router, firmware version 3.00b32. The flaw sits in the rp-l2tp component — specifically the tunnel_set_params function inside tunnel.c, which handles L2TP tunnel setup. Manipulating the peer_hostname argument passed to this function causes data to be written past the bounds of its intended buffer. The vulnerability was reserved September 23, 2026 and published to the National Vulnerability Database (NVD) on September 24, 2026, credited to VulDB.

The vulnerability carries a CVSS 3.1 score of 9.8 (Critical) and a CVSS 4.0 score of 9.3 — both reflecting a flaw that is remotely exploitable, requires no authentication, and needs no user interaction. Because tunnel_set_params runs as part of L2TP tunnel negotiation, an attacker who can reach a vulnerable device's L2TP service (UDP 1701) can trigger the overflow without ever logging in.

The DIR-825 is a discontinued D-Link product, and as of publication no fixed firmware has been released. Public advisories reviewed do not describe the exact memory region overwritten or confirm a working remote-code-execution proof of concept, but out-of-bounds writes reachable from unauthenticated network input are a well-established path to control-flow hijacking or denial of service on embedded router firmware — and this device will not receive a vendor fix.

Vulnerability Overview

Affected Versions

D-Link has not published an advisory or patched firmware for this CVE at the time of writing. The DIR-825 has been out of D-Link's support lifecycle for several years; vendors typically do not issue security fixes for discontinued consumer router models, which means this vulnerability should be treated as permanently unpatched absent an unexpected vendor reversal.

A closely related flaw was also reported for the D-Link DIR-822A, affecting the same tunnel_set_params logic in that device's L2TP control-message parser — suggesting the vulnerable code traces back to a shared rp-l2tp codebase reused across multiple D-Link router models.

Attack Vector

1. Attacker identifies a D-Link DIR-825 (firmware 3.00b32) with its
   L2TP service reachable over the network (UDP 1701) — whether
   exposed directly to the internet or reachable from an internal
   network segment.
 
2. Attacker initiates or manipulates L2TP tunnel setup traffic to the
   device, crafting the "peer_hostname" field sent during tunnel
   negotiation.
 
3. The device's rp-l2tp component calls tunnel_set_params() in
   tunnel.c to process the supplied peer_hostname value.
 
4. tunnel_set_params() copies the attacker-controlled peer_hostname
   into a fixed-size buffer without adequate bounds checking, writing
   past the buffer's allocated end (CWE-787).
 
5. Depending on what memory is overwritten, the result can range from
   a router crash/reboot (denial of service) to corruption of adjacent
   control data that could be leveraged toward further code execution
   on the device.
 
6. No authentication or prior access is required — the vulnerable code
   path is reached during normal, unauthenticated L2TP tunnel setup.

Impact of Successful Exploitation

Immediate Remediation

Because no patch exists and none is expected for this end-of-life device, remediation is limited to mitigation and replacement:

Restrict and disable the vulnerable service

• Disable L2TP on the DIR-825 if it is not actively required for VPN connectivity.
• If L2TP must remain enabled, block UDP 1701 at the network perimeter so the service is reachable only from explicitly trusted source IP addresses.
• Never expose the DIR-825's L2TP service directly to the public internet. Place it behind a dedicated perimeter firewall or route L2TP traffic through a VPN gateway you control instead.

Segment and monitor

• Move any DIR-825 still in service onto an isolated VLAN or guest network segment to limit lateral movement if the device is compromised.
• Monitor for unexpected reboots, connectivity drops, or anomalous L2TP traffic patterns to the device, which may indicate exploitation attempts.

Replace the hardware

• The DIR-825 is end-of-life and will not receive a firmware fix for this or future vulnerabilities. Budget for replacement with a currently supported router model that receives active security patches, especially for any deployment facing the internet.

Detection Indicators

Post-Remediation Steps

1. Inventory your environment for any D-Link DIR-825 devices and confirm their firmware version.
2. Disable L2TP on affected devices where it is not required, or restrict UDP 1701 to trusted sources only.
3. Isolate any DIR-825 that must remain in service on its own network segment, away from sensitive hosts.
4. Plan and budget for replacement of end-of-life D-Link hardware with actively supported router models.
5. Continue monitoring NVD and D-Link's security advisory channel in case an unexpected firmware update is issued.

References

• NVD — CVE-2026-96891
• Strix — CVE-2026-96891: DIR-825 Memory Corruption (CVSS 9.8)
• TheHackerWire — CVE-2026-96891: D-Link DIR-825 Out-of-Bounds Write Enables Remote Critical Compromise