D-Link warns of critical vulnerabilities in legacy DIR-822A routers with public exploit code

According to Bleeping Computer, D-Link has issued a warning about two maximum-severity vulnerabilities affecting its legacy DIR-822A dual-band Wi-Fi routers. Both flaws have publicly available proof-of-concept exploit code, and no patches are currently available.

The first vulnerability, CVE-2026-86296, is a stack-based buffer overflow in the DHCP server component. Attackers on the same local network can exploit this without authentication by sending crafted DHCP packets, potentially leading to device crashes or remote code execution. The second, CVE-2026-86510, is a critical out-of-bounds write in the L2TP control message parser. This can be triggered by manipulating input data, causing arbitrary memory corruption for devices using L2TP or L2TPv6 WAN connectivity.

D-Link advises customers to ensure their DIR-822A routers are not exposed online and to restrict remote management access. While these specific vulnerabilities are not yet reported as exploited, D-Link devices are frequently targeted and added to botnets for DDoS attacks. The Cybersecurity and Infrastructure Security Agency tracks numerous exploited D-Link flaws.

Source: Bleeping Computer