CVE-2026-86295
HighCVSS 8.3Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
A vulnerability was found in D-Link DIR-895L A1_102b07 in the sendACK function of the file udhcpcd/serverpacket.c in the udhcpcd component. Manipulation of the argument Hostname results in command injection. The attack can be executed remotely and the exploit has been made public.
Risk Assessment
A remote attacker can inject and execute arbitrary system commands on the device, potentially leading to full compromise of the device and the network.
Recommendation
Immediately update the D-Link DIR-895L firmware to the latest available version if a patch is released. Also restrict external access to the device.
Other vulnerabilities in D-Link DIR-895L
See all- CVE-2026-100740Critical
A vulnerability in D-Link DIR-895L A1_102b07 affects the tunnel_set_params function in tunnel.c of the L2TP Control Channel Parser component. Manipulation results in an out-of-bounds write. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-86509Critical
The D-Link DIR-895L router version A1_102b07 has a vulnerability in the sendOffer/sendACK functions of the file udhcpcd/serverpacket.c in the udhcpcd component, causing a stack-based buffer overflow. The attack can only be performed within the local network, and the exploit has been published.
Original NVD description (English source)
A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS