Emerging ThreatsMalware & Ransomware

D-Link Routers Expose Zero-Day Flaw to Remote Attacks

Analyst 207||Source: BleepingComputer
Router sits on table amidst cables and networking gear in a home office setting.

"A specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function," D‑Link wrote in a Friday advisory.

The DHCP stack overflow in udhcpcd/serverpacket.c

D‑Link has disclosed a maximum-severity, unauthenticated zero-day affecting DIR‑822A routers that stems from a stack-based buffer overflow in the device's DHCP server component. The company traces the flaw to the strcpy call in udhcpcd/serverpacket.c. According to the advisory, attackers on the same local network — without valid credentials and without any user interaction — can send crafted DHCP packets that trigger the overflow. Successful exploitation may crash the device's DHCP daemon or achieve remote code execution and thereby affect confidentiality, integrity, or availability.

Public proof-of-concept increases weaponization risk

D‑Link warned that the researcher who reported the bug has published a proof‑of‑concept exploit. The vendor said the exploit has been publicly disclosed and "may be utilized," a phrase that underlines the practical risk: once a working PoC is available, the window for weaponization in the wild narrows and opportunistic attackers can test and adapt exploits rapidly.

CVE‑2026‑86510: out‑of‑bounds write in L2TP control message parser

In addition to the DHCP stack overflow, D‑Link is investigating a second vulnerability affecting DIR‑822A routers: a critical out‑of‑bounds write tracked as CVE‑2026‑86510 in the L2TP control message parser. Reported by the same researcher, the flaw can be abused by threat actors with basic privileges to trigger arbitrary memory corruption. D‑Link's advisory notes the attack targets devices configured to use L2TP or L2TPv6 for WAN connectivity and depends on manipulating input data to cause the out‑of‑bounds write.

D‑Link's guidance and patch status

D‑Link said it is investigating both flaws and is "working on security patches." While patches are under development, the company advised DIR‑822A customers to reduce exposure: ensure routers are not reachable from the public internet, restrict remote management access, and limit administrative access to trusted systems and users via firewall or network‑access controls. The vendor also noted that, so far, it has not flagged these specific vulnerabilities as exploited in active attacks.

What this means for technologists, CISA, and end users

  • Technologists and security teams: The public PoC and the unauthenticated nature of the DHCP flaw mean defenders should prioritize network segmentation and temporary hardening measures for DIR‑822A devices — particularly removing any internet exposure and disabling remote management until vendor patches are available.
  • CISA and regulators: The advisory arrives against a backdrop the vendor acknowledged: the Cybersecurity and Infrastructure Security Agency tracks 26 D‑Link security flaws that have been or remain exploited in attacks, including two abused by ransomware gangs. That record is the context for elevated scrutiny and an urgency to receive timely patches and telemetry from affected networks.
  • End users and home/SMB operators: Owners of DIR‑822A routers should follow D‑Link's immediate mitigations — ensure devices are not exposed online, restrict remote management, and apply network‑level controls to administrative interfaces — while awaiting vendor updates.

D‑Link's disclosure combines a technical diagnosis with pragmatic steps: the strcpy call in udhcpcd creates a classic buffer‑overflow pathway, and the availability of a public PoC accelerates the risk timeline. The company is investigating a second, L2TP‑related bug at the same time. Neither flaw has yet been flagged by D‑Link as seen in exploitation, but the vendor warned of the broader pattern of attackers targeting vulnerable D‑Link devices and of the large‑scale botnets that have historically leveraged such exposures for distributed denial‑of‑service activity. For operators of DIR‑822A equipment, that pattern and the public proof‑of‑concept together argue for swift hardening and close tracking of the vendor's forthcoming patches.

Original report: https://www.bleepingcomputer.com/news/security/d-link-warns-of-max-severity-zero-day-bug-in-dir-822a-routers/

Buffer OverflowEmerging ThreatsNetwork SecurityRemote Code ExecutionSupply ChainZero-DayIot SecurityD-LinkRouter VulnerabilityDHCP
Related Intelligence

Continue Reading

Security researcher pauses over laptop keyboard, surrounded by notes and peripherals.

Microsoft Defender Zero-Day Blocks Antivirus Updates

A security researcher just released a clever tool called BigDiskBuster that can block Microsoft Defender updates, leaving your antivirus stuck in limbo. This sneaky proof-of-concept allows anyone to prevent Defender from getting the latest signature and platform updates, as long as the tool is running in the background.

Analyst 207
Laptop screen displays code in a coding environment amidst office workspace elements.

Malicious npm Packages Evade Detection by Hiding in Runtime Code

A sneaky malicious npm package, indexed-btree, has been hiding in plain sight by disguising its loader inside ordinary library code, allowing it to evade detection and rack up millions of downloads. This cleverly crafted package mimicked a legitimate B-tree utility, but with a sinister twist that went undetected until it was removed from the npm registry.

Analyst 207
Checkout terminal screen in focus with cashier and blurred customer in background.

AI Fuels 300% Surge in Bot Traffic, Exposes Enterprise Vulnerabilities

Last year, bot traffic skyrocketed by 300% thanks to AI, leaving enterprises vulnerable to automated threats. This alarming surge, driven by generative tools, puts commerce at the forefront of the crosshairs, with retailer systems and transactions under relentless attack.

Analyst 207
University library interior with students, laptop, and educational materials on a table.

SideCopy Targets Indian Academia with ReverseRAT Spear-Phishing

SideCopy, a notorious Pakistani threat actor, has set its sights on Indian academia with a cunning spear-phishing campaign, marking a tactical shift from its previous targets of government and defense forces. Using malicious scripts to evade security protocols, this group is now compromising academic institutions in India.

Analyst 207