Critical D-Link Router Flaw CVE-2024-39148 Lets Attackers Remotely Execute Code

Key Takeaways

• D-Link is actively investigating a critical remote code execution flaw, CVE-2026-86296, affecting its DIR-822A router.
• The vulnerability carries a maximum CVSS score of 10.0, indicating severe risk.
• Attackers can exploit this flaw without authentication or user interaction, potentially leading to full device compromise.
• A public proof-of-concept (PoC) exploit has been reported, increasing the urgency for users to mitigate risks.
• A second critical flaw, CVE-2026-86510 (CVSS 9.9), also impacts the same router model.

D-Link Router Facing Critical Remote Code Execution Vulnerability

D-Link Systems has initiated an investigation into a severe security vulnerability impacting its DIR-822A router, identified as CVE-2026-86296. This flaw has been assigned the highest possible CVSS severity rating of 10.0, signaling an extreme risk. The vulnerability could enable remote attackers to gain unauthorized control over affected devices without requiring any authentication or user interaction.

Technical Details of CVE-2026-86296

The core of this critical issue lies within the udhcpcd component of the DIR-822A router, specifically in firmware version A_101. Researchers pinpointed a stack-based buffer overflow in the udhcpcd/serverpacket.c source file. This occurs because the unsafe strcpy function is utilized to copy attacker-controlled data into a fixed-size stack buffer. Should the specially crafted input exceed the allocated buffer space, it can overwrite adjacent memory regions. Such an event could lead to device instability, service outages, or, more critically, allow an attacker to execute arbitrary code on the router.

D-Link has confirmed its ongoing investigation into the vulnerability, noting that it has not yet validated the full scope of affected hardware revisions, regional product distribution, or the status of firmware patches. CVE-2026-86296 is categorized under CWE-121 (Stack-Based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The published CVSS v3.1 vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R, illustrates that the attack can be launched over a network with low complexity. Importantly, attackers do not need credentials, local network access, or any interaction from the victim.

Successful exploitation of this flaw could severely compromise confidentiality, integrity, and availability, making it particularly dangerous for routers directly exposed to the internet. The reported release of a public proof-of-concept (PoC) exploit heightens the potential for active exploitation, as threat actors may quickly integrate this research into their attack toolkits. Organizations utilizing the DIR-822A router should therefore prioritize this as an urgent exposure management concern, even as D-Link continues its validation process.

Second Critical Flaw: CVE-2026-86510

In addition to CVE-2026-86296, D-Link has also acknowledged a second critical vulnerability affecting the same DIR-822A A_101 firmware version. This flaw, tracked as CVE-2026-86510, is an out-of-bounds write vulnerability found in the tunnel_set_params function of the L2TP Control Message Parser. It carries a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4. Unlike the first vulnerability, CVE-2026-86510 requires low privileges for exploitation but similarly does not demand user interaction. It could lead to memory corruption through specially crafted L2TP control messages. A public proof-of-concept has also been reported for this vulnerability.

What You Should Do

• Verify Router Details: D-Link recommends that DIR-822A owners accurately verify their specific model, hardware revision, and installed firmware version before taking any mitigation steps.
• Limit Exposure: Avoid exposing router administration interfaces directly to the internet. Disable remote management features if they are not absolutely essential for your operations.
• Restrict Access: Limit administrative access to trusted systems and networks only.
• Monitor for Updates: Regularly check your regional D-Link support portal for official firmware updates and product security advisories.
• Caution with Firmware: Be aware that firmware is specific to hardware revisions. Installing an incorrect firmware image can damage your device or leave it vulnerable.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.