D-Link finds a severe flaw in DIR-822A routers with no fix yet

D-Link has confirmed a maximum-severity flaw in its DIR-822A dual-band Wi-Fi router with a CVSS score of 10.0 out of 10, and the company has no patch ready. The bug, tracked as CVE-2026-86296, lets an attacker on the network send crafted DHCP packets that overflow a stack buffer, with public proof-of-concept exploit code already circulating.

A second, related flaw in the same router, CVE-2026-86510, scores nearly as high at 9.9 and sits in a completely different part of the device’s software, the code that parses L2TP tunneling connections. D-Link says both remain under investigation, with no timeline for a fix.

Security news outlet BleepingComputer, which first reported the pair of flaws on September 22, described the DHCP bug as reaching the maximum possible severity rating a router vulnerability can carry, a description that matches the numbers in D-Link’s own advisory.

A Stack Overflow Inside the DHCP Server

The primary flaw traces to the router’s udhcpcd component, the software that hands out network addresses to devices joining the network. D-Link’s own advisory, numbered SAP10516, attributes the bug to unsafe use of the strcpy function, writing that “a specially crafted request may cause data to exceed the available stack buffer when processed by the strcpy function.” An attacker who sends such a request over the local network can trigger memory corruption without needing a password or any authentication at all, potentially crashing the router’s DHCP daemon or gaining the ability to execute code on the device.

The GitHub Security Advisory database, which independently tracks and verifies vulnerability reports, lists the flaw’s root cause the same way D-Link does: an unsafe strcpy call inside udhcpcd’s serverpacket.c file that lets crafted input overrun a fixed-size buffer on the stack. Rapid7’s own vulnerability database separately puts the flaw’s severity at a 9.3 CVSS score under its scoring methodology, a few tenths below D-Link’s own 10.0 rating but still in the range reserved for the internet’s most dangerous, remotely exploitable bugs.

A Second Flaw in L2TP Parsing

CVE-2026-86510 is a separate out-of-bounds write bug in the router’s L2TP control-message parser, specifically in a function called tunnel_set_params. Unlike the DHCP flaw, this one requires an attacker to already hold some low-level privileges on the device, but it can still be triggered remotely and needs no interaction from a device owner once that low bar is cleared. D-Link’s advisory treats the two bugs as related enough to disclose together, even though they sit in entirely different pieces of the router’s firmware.

Security outlet GBHackers, which reviewed the same advisory, reported both vulnerabilities carry public proof-of-concept code, meaning the technical barrier to writing a working exploit has already been cleared by someone outside D-Link, well before the company has a fix ready to ship. SC Media’s security desk, in a separate brief on the disclosure, flagged the DIR-822A’s legacy status as a factor that could complicate how quickly, or whether, D-Link decides the model is still worth patching at all.

Neither flaw requires a device owner to click anything or take any action. That is what separates a router bug like this from the phishing-style attacks that dominate most consumer security warnings: the DHCP flaw in particular can be triggered by any device already connected to the same local network, without a password, a login prompt, or a moment of inattention from anyone in the household.

No Fix, and No Timeline for One

D-Link’s advisory lists the status of both vulnerabilities as under investigation, and the company has not said when, or whether, a firmware update will arrive. The DIR-822A is a legacy model, and D-Link’s guidance amounts to telling owners to lock the router down rather than promising a repair. The company’s advisory tells customers to keep the device off the open internet, disable remote management unless it is strictly necessary, and use firewall rules to restrict administrative access to trusted devices only.

D-Link’s advisory was first published September 18 and updated September 21, a three-day gap during which the company appears to have been narrowing down exactly which hardware revisions of the DIR-822A are affected; the advisory still lists the affected hardware revision as unconfirmed. That detail matters because D-Link sells router models under the same name with different internal hardware across different regions, and a fix timeline, once one exists, will likely depend on which specific revisions the company confirms are vulnerable.

For now, the combination of a 10.0 severity score, no patch, and public exploit code leaves DIR-822A owners with only the mitigations D-Link has published. Anyone still running the router with remote management enabled, or with the device’s administrative interface reachable from the open internet, is the population D-Link’s advisory is most directly warning.

The DIR-822A has been on the market for years, long enough that many owners may not know it by its model number at all, only as whatever router their internet provider or a retailer sold them at some point. D-Link’s advisory does not say how many units are still in active use, and without a firmware fix in hand, the company’s own guidance is the only defense available to whoever is still running one.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview