CVE-2026-86509
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The D-Link DIR-895L router version A1_102b07 has a vulnerability in the sendOffer/sendACK functions of the file udhcpcd/serverpacket.c in the udhcpcd component, causing a stack-based buffer overflow. The attack can only be performed within the local network, and the exploit has been published.
Risk Assessment
An attacker with local network access could exploit this vulnerability to execute arbitrary code on the router, potentially leading to full control over the device and network.
Recommendation
Update the router firmware to the latest version and limit trust to devices on the local network.
Other vulnerabilities in D-Link DIR-895L
See all- CVE-2026-100740Critical
A vulnerability in D-Link DIR-895L A1_102b07 affects the tunnel_set_params function in tunnel.c of the L2TP Control Channel Parser component. Manipulation results in an out-of-bounds write. The attack can be initiated remotely, and the exploit is now public.
- CVE-2026-86295High
A vulnerability was found in D-Link DIR-895L A1_102b07 in the sendACK function of the file udhcpcd/serverpacket.c in the udhcpcd component. Manipulation of the argument Hostname results in command injection. The attack can be executed remotely and the exploit has been made public.
Original NVD description (English source)
A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS