Critical Vulnerabilities in D-Link Routers

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

CVE-2026-86296, CVE-2026-86510

Other

September 22, 2026

Executive Summary

A stack-based buffer overflow and an L2TP out-of-bounds write enable code execution and memory corruption.

Key Details

Affected Platform

D-Link Routers

Attack Surface

Recommended Action

Affected Environment

D-Link DIR-822A routers running firmware version A_101, widely deployed in home and small business networks.

Operational Impact

Arbitrary code execution, memory corruption, denial of service, or full compromise of the router.

Technical Root Cause

Unsafe strcpy use in DHCP option 125 parsing and an oversized L2TP Host Name AVP.

Recommended Mitigation

Restrict internet exposure, disable remote management, and monitor D-Link's regional support portal for updates.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

cybersecuritynews.com, tzh00203.notion.site advisories.