CVE-2026-86295

HighCVSS 8.3

Published: 07/09/2026(UTC)Translated: 07/09/2026(UTC)NVD NIST

Summary

A vulnerability was found in D-Link DIR-895L A1_102b07 in the sendACK function of the file udhcpcd/serverpacket.c in the udhcpcd component. Manipulation of the argument Hostname results in command injection. The attack can be executed remotely and the exploit has been made public.

Risk Assessment

A remote attacker can inject and execute arbitrary system commands on the device, potentially leading to full compromise of the device and the network.

Recommendation

Immediately update the D-Link DIR-895L firmware to the latest available version if a patch is released. Also restrict external access to the device.

Other vulnerabilities in D-Link DIR-895L

CVE-2026-86509Critical
The D-Link DIR-895L router version A1_102b07 has a vulnerability in the sendOffer/sendACK functions of the file udhcpcd/serverpacket.c in the udhcpcd component, causing a stack-based buffer overflow. The attack can only be performed within the local network, and the exploit has been published.

Original NVD description (English source)

A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.