CVE-2026-86297

HighCVSS 8.1

Published: 07/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 07/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.05%

62th percentile - higher than 62% of all known CVEs

Summary

A vulnerability was identified in D-Link DIR-605 B1v202WWB03 in the tunnel_set_params function of the file progs.gpl/pppd.alpha/l2tp/tunnel.c in the L2TP Control Message Parser component. Manipulation of the argument peer_hostname leads to an off-by-one error. The attack may be performed remotely but is highly complex and difficult to exploit. The exploit is publicly available.

Risk Assessment

Despite the difficulty of exploitation, a remote attacker could potentially cause a crash or gain unauthorized access to the device, compromising network security.

Recommendation

Monitor vendor advisories and update the D-Link DIR-605 firmware when a patch is available. Restricting external access to the device may reduce risk.

Other vulnerabilities in D-Link DIR-605

CVE-2025-14884High
A vulnerability was detected in D-Link DIR-605 202WWB03 in an unknown function of the Firmware Update Service component. Manipulation leads to command injection, and the attack can be initiated remotely. The exploit is now public and may be used; this vulnerability only affects products no longer supported by the maintainer.

Original NVD description (English source)

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS