CVE-2026-86509

CriticalCVSS 9.6

Published: 08/09/2026(UTC)Translated: 08/09/2026(UTC)NVD NIST

Summary

The D-Link DIR-895L router version A1_102b07 has a vulnerability in the sendOffer/sendACK functions of the file udhcpcd/serverpacket.c in the udhcpcd component, causing a stack-based buffer overflow. The attack can only be performed within the local network, and the exploit has been published.

Risk Assessment

An attacker with local network access could exploit this vulnerability to execute arbitrary code on the router, potentially leading to full control over the device and network.

Recommendation

Update the router firmware to the latest version and limit trust to devices on the local network.

Other vulnerabilities in D-Link DIR-895L

CVE-2026-86295High
A vulnerability was found in D-Link DIR-895L A1_102b07 in the sendACK function of the file udhcpcd/serverpacket.c in the udhcpcd component. Manipulation of the argument Hostname results in command injection. The attack can be executed remotely and the exploit has been made public.

Original NVD description (English source)

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.