D-Link has warned of a D-Link router vulnerability affecting DIR-822A Wi-Fi routers. Public proof-of-concept code is available for the maximum-severity flaw, but D-Link has not released a patch.
An attacker on the same local network could exploit the flaw without a password or user interaction. D-Link is also investigating a second vulnerability in the routers.
DHCP Flaw Could Crash the Router or Allow Code Execution
The main vulnerability, CVE-2026-86296, affects the router’s DHCP server. The component handles network configuration requests from connected devices.
Improper handling of a crafted DHCP packet can cause a stack-based buffer overflow. An attacker on the local network could use that flaw to crash the DHCP service or potentially run code on the router.
The researcher who reported the issue has published proof-of-concept exploit code. As a result, others can examine how to trigger the flaw.
D-Link Investigates a Second DIR-822A Vulnerability
D-Link is also investigating CVE-2026-86510, a critical flaw in the router’s L2TP control message parser. The same researcher published proof-of-concept code for this issue.
The second flaw could allow an attacker with basic privileges to corrupt memory on a device configured for L2TP or L2TPv6 WAN connectivity. Its relevance therefore depends on the router’s configuration.
Router Owners Should Restrict Access
D-Link is working on patches for both vulnerabilities. Meanwhile, it advises DIR-822A owners to prevent internet exposure, restrict remote management and allow administrative access only from trusted systems.
The company has not reported attacks exploiting these two flaws. However, public exploit code and the absence of patches make it important for owners to check their router settings and watch for D-Link updates.
0 responses to “D-Link Warns of Unpatched DIR-822A Router Vulnerability”