D-Link flags unpatched critical flaw in legacy routers with public exploit
D-Link has disclosed a maximum-severity vulnerability in its DIR-822A routers, tracked as CVE-2026-86296, which stems from a stack-based buffer overflow in the DHCP server and can be exploited without authentication. A public proof-of-concept exploit has been released, and the company is also investigating a second critical out-of-bounds write issue in the L2TP parser. No patch is available yet, so D-Link advises limiting remote access and keeping the devices off the internet.
The vulnerability resides in the udhcpcd component, specifically in the strcpy function within serverpacket.c, where crafted DHCP packets can overflow the stack buffer. Because exploitation requires no authentication, any device on the same local network could potentially trigger memory corruption or execute arbitrary code. The second flaw, CVE-2026-86510, affects the L2TP control message parser and requires basic privileges, but could also lead to arbitrary memory corruption on devices using L2TP WAN connections.
D-Link's advisory notes the researcher published exploit code publicly, accelerating the threat window. The company has not confirmed active exploitation, but the pattern is concerning: CISA currently tracks 26 D-Link flaws that have been exploited in attacks, with two also abused by ransomware gangs. Legacy routers like the DIR-822A are frequent targets for botnet recruitment, particularly for DDoS operations, making the lack of a patch especially problematic for users who still rely on these devices.
This disclosure highlights the ongoing risk posed by legacy networking hardware that vendors no longer actively support. Home users and small businesses still operating DIR-822A routers may face exposure to remote code execution and botnet recruitment, potentially compromising their networks and enabling large-scale DDoS attacks. Without a patch, affected users must rely on manual mitigation steps, which many may not implement. The public exploit could accelerate real-world attacks, though the requirement for local network access may limit immediate widespread impact.