CVE-2026-86510PoC

MEDIUMCVSS 8.6 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-119CWE-787

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

RISING

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
9 mentions across 5 observed days
Momentum state: rising

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 5 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 7 signals
General: 2 classified signals
Disclosure: 2 classified signals
Peaked 2d ago at 3 mentions (2026-09-22); latest day: 2
9 total mentions across 5 days

Deep dive

Activity timeline9 mentions / 5d

Signal classification4 categories

PoC

444.4%

General

222.2%

Disclosure

222.2%

Patch

111.1%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-07	1	General1
2026-09-10	1	General1
2026-09-22	3	Disclosure1PoC2
2026-09-23	2	Disclosure1PoC1
2026-09-25	2	Patch1PoC1

Full discourse9 posts

Dark Web Intelligence@DailyDarkWeb31d
PoC
🚨 D-LINK DIR-822A CRITICAL FLAW — UNAUTH STACK OVERFLOW VIA DHCP (CVE-2026-86296), PUBLIC POC, NO PATCH YET D-Link has published security bulletin SAP10516 for a critical stack-based buffer overflow in the DIR-822A (Non-US) router’s udhcpcd DHCP component, and says a public proof-of-concept has been reported. No firmware fix is available yet — status remains Under Investigation. • CVE-2026-86296 — CVSS 10.0 Critical (vendor-cited CVE scoring) • Product: DIR-822A firmware A_101 (Non-US); hardware revision still under confirmation • Flaw: unbounded strcpy in udhcpcd/serverpacket.c while parsing DHCP / TR-111 Option 125 • Unauthenticated, no user interaction; network attack vector per the CVE record • Successful exploitation may cause memory corruption and can impact confidentiality, integrity, and availability (crash or potential RCE on the device) • Public PoC reported; D-Link has not released a security update as of the 21 Sep 2026 bulletin update • Same bulletin also tracks a second DIR-822A issue under investigation: CVE-2026-86510 (L2TP tunnel_set_params out-of-bounds write) • Researcher credit: tian (acknowledged by D-Link) ⚠️ Analyst Note: DHCP parsing is typically reachable from the LAN / adjacent segment (including guest or open Wi-Fi), so internet-wide remote exposure may be lower than a raw AV:N CVSS string suggests — but any untrusted device on the same broadcast domain can still reach the service. This is an official vendor acknowledgement of an unpatched critical router flaw with a reported public PoC, not confirmation of mass in-the-wild exploitation. Confirm exact model, hardware revision, and firmware before acting; install only D-Link firmware intended for that revision when a fix ships. Until then: keep the device off unnecessary internet exposure, restrict remote management, and limit who can hit the LAN DHCP path. Original D-Link security bulletin (SAP10516): https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10516 #DLink #DIR822A #CVE202686296 #RouterSecurity #ZeroDay #IoT #CyberSecurity #ThreatIntel #DDW #DarkWeb
Post summary
The post centers on a vendor-acknowledged critical unauthenticated DHCP stack overflow in D-Link DIR-822A with a reported public PoC, no available firmware fix, and detailed vulnerability information. It includes interim mitigations but does not confirm active in-the-wild exploitation.
210826.9K
209.0K followersView on X
Ryx@PadhiyarRushi28d
PoC
DIR-822A DHCP "strcpy" is CVSS 10.0. No patch. Public PoC is out!!!! CVE-2026-86296: LAN attacker sends a crafted DHCP packet. "udhcpcd/serverpacket.c" copies into a stack buffer with "strcpy". Crash or RCE, no auth, no click. Companion bug CVE-2026-86510 is an OOB write in "tunnel_set_params" on the L2TP path. Firmware A_101: D-Link SAP10516 still says under investigation. https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10516 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #IoT #Router #RCE
Post summary
The post highlights a critical vulnerability in DIR-822A DHCP with a public proof-of-concept, describing a stack buffer overflow that can lead to RCE without authentication.
00083643
954 followersView on X
VulDB 🛡@vuldb46d
General
A severe vulnerability was disclosed for D-Link DIR-822A (CVE-2026-86510) https://vuldb.com/vuln/399663
Post summary
The text reports a severe vulnerability (CVE‑2026‑86510) for the D‑Link DIR‑822A, but provides no additional details about PoC, exploit code, active exploitation, patches, or technical specifics.
00001107
2.3K followersView on X
BT Haberler@BTHaberler28d
Patch
D-Link, Artık Desteklenmeyen DIR-822A Yönlendiricilerindeki İki Kritik Sıfır Günü İçin Yama Yayınlamayacağını Açıkladı! D-Link, kullanım ömrü sona ermiş DIR-822A çift bant yönlendiricilerini etkileyen iki kritik açık için uyarı yayınladı: CVE-2026-86296, DHCP sunucu bileşenindeki bir stack overflow açığı olup yerel ağdaki bir saldırganın özel hazırlanmış bir DHCP paketiyle hizmet dışı bırakma veya uzaktan kod çalıştırma sağlamasına izin veriyor; CVE-2026-86510 ise L2TP/L2TPv6 protokol ayrıştırıcısındaki bir "sınır dışı yazma" açığı. • Her iki açık için de kanıt niteliğinde çalışan istismar kodu (PoC) zaten kamuya açık, ancak cihazlar artık desteklenmediği için resmi bir yama gelmeyecek. • D-Link, kullanıcılara cihazları internetten erişilebilir bırakmamalarını ve yönetim erişimini kısıtlamalarını öneriyor. Bir üreticinin, kamuya açık istismar kodu bulunan kritik açıklar için "artık desteklenmiyor, kendiniz önlem alın" demesi, kullanım ömrü dolan ağ donanımlarının atılana kadar sessizce büyüyen, sahipsiz bir güvenlik riski biriktirdiğini gösteriyor. #SiberGüvenlik #DLink #SıfırGün
Post summary
The text reports on D-Link's vendor advisory confirming that no patches will be issued for two critical vulnerabilities (CVE-2026-86296, CVE-2026-86510) in end-of-life DIR-822A routers, despite public availability of working PoC exploit code, and advises workarounds such as restricting internet exposure and management access.
0000048
43 followersView on X
General Intels Daily@intels_daily30d
PoC
🔴 𝗖𝗥𝗜𝗧𝗜𝗖𝗔𝗟 · 𝗢𝘁𝗵𝗲𝗿 🏢 Target: 𝗗-𝗟𝗶𝗻𝗸 🧩 Product: 𝗗-𝗟𝗶𝗻𝗸 𝗗𝗜𝗥-𝟴𝟮𝟮𝗔 🛡️ CVE-2026-86296, CVE-2026-86510 D-Link has issued a warning regarding a critical buffer overflow vulnerability (CVE-2026-86296) in DIR-822A routers, allowing unauthenticated remote code execution via DHCP packets. A PoC is available. A second vulnerability (CVE-2026-86510) in the L2TP parser is also under investigation. #ThreatIntel #CTI
Post summary
D-Link DIR-822A critical buffer overflow (CVE-2026-86296) enabling unauthenticated RCE via DHCP packets with a PoC available; CVE-2026-86510 in the L2TP parser is also under investigation.
00000134
727 followersView on X
Orion84@Orion84x30d
Disclosure
A second critical flaw, CVE-2026-86510, hits the L2TP parser on the same model. These belong on guest or small-office Wi-Fi, not as a trusted LAN device
Post summary
The text discloses CVE-2026-86510, a critical flaw in the L2TP parser of a network device, and advises its use only in untrusted guest or small-office Wi-Fi environments.
0000043
21 followersView on X
CyberPulse@CyberPulse5631d
PoC
‼️CRITICAL VULNERABILITY — D-Link DIR-822A D-Link has disclosed CVE-2026-86296, a CVSS 10.0 critical stack-based buffer overflow affecting the non-US DIR-822A router. The flaw is in the udhcpcd DHCP component and can be exploited without authentication or user interaction using specially crafted network requests. A public PoC has reportedly been published. A second issue, CVE-2026-86510, has also been reported as a critical memory-corruption vulnerability involving the L2TP control-message parser. Affected product: D-Link DIR-822A Reported firmware: A_101 CVE: CVE-2026-86296 Severity: Critical — CVSS 10.0 Attack requirement: Network access; no authentication required Patch: Under investigation / no confirmed security update at the time of D-Link’s advisory Active exploitation: No active exploitation reported by D-Link D-Link recommends not exposing affected routers unnecessarily to the Internet, disabling remote management where possible, and restricting administrative access to trusted systems while its investigation continues. #CyberSecurity #DLink #CVE202686296 #CVE202686510 #ZeroDay #RouterSecurity #VulnerabilityAlert
Post summary
D-Link disclosed CVE‑2026‑86296, a critical 10.0 stack‑based buffer overflow in the DIR‑822A router’s DHCP component, with a public PoC published; no patch or active exploitation is reported.
00000332
2.5K followersView on X
zoomeyebot@zoomeyebot31d
Disclosure
🚨 CVE-2026-86510: D-Link DIR-822A L2TP Out-of-Bounds Write Exposes Routers to LAN Code Execution Critical Vulnerability Alert! D-Link DIR-822A is affected by CVE-2026-86510. 🔍 Identify Targets via ZoomEye: Filter: app="D-Link" Search Dork: title="DIR-822" Exposure: 6.7m instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJELUxpbmsi #CVE202686510 #DLink #DIR822A #BufferOverflow #RouterSecurity #Vulnerability
Post summary
The post announces CVE-2026-86510, a critical L2TP out-of-bounds write vulnerability in D-Link DIR-822A routers allowing LAN code execution, and shares ZoomEye search dorks to locate 6.7 million potentially exposed instances globally.
0000041
24 followersView on X
Cybersecurity News DE@cybsecuritynews43d
General
#schwachstellen Zwei kritische D-Link-Lücken: eine im LAN, eine aus der Ferne angreifbar #cve202686509 #cve202686510 #dlink #dir822a #dir895l https://cybersecurity-news.de/d-link-cve-2026-86509-cve-2026-86510-router-schwachstellen
Post summary
Two critical D-Link router vulnerabilities—one accessible from the LAN, the other from remote—are referenced, but the post provides no further technical or exploit details.
0000031
12 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-86510

Dark Web Intelligence[verified]@DailyDarkWebPoC

The post centers on a vendor-acknowledged critical unauthenticated DHCP stack overflow in D-Link DIR-822A with a reported public PoC, no available firmware fix, and detailed vulnerability information. It includes interim mitigations but does not confirm active in-the-wild exploitation.

Ryx[verified]@PadhiyarRushiPoC

The post highlights a critical vulnerability in DIR-822A DHCP with a public proof-of-concept, describing a stack buffer overflow that can lead to RCE without authentication.

BT Haberler[verified]@BTHaberlerPatch

The text reports on D-Link's vendor advisory confirming that no patches will be issued for two critical vulnerabilities (CVE-2026-86296, CVE-2026-86510) in end-of-life DIR-822A routers, despite public availability of working PoC exploit code, and advises workarounds such as restricting internet exposure and management access.

General Intels Daily[verified]@intels_dailyPoC

D-Link DIR-822A critical buffer overflow (CVE-2026-86296) enabling unauthenticated RCE via DHCP packets with a PoC available; CVE-2026-86510 in the L2TP parser is also under investigation.

CyberPulse[verified]@CyberPulse56PoC

D-Link disclosed CVE‑2026‑86296, a critical 10.0 stack‑based buffer overflow in the DIR‑822A router’s DHCP component, with a public PoC published; no patch or active exploitation is reported.

zoomeyebot[verified]@zoomeyebotDisclosure

The post announces CVE-2026-86510, a critical L2TP out-of-bounds write vulnerability in D-Link DIR-822A routers allowing LAN code execution, and shares ZoomEye search dorks to locate 6.7 million potentially exposed instances globally.

VulDB 🛡@vuldbGeneral

The text reports a severe vulnerability (CVE‑2026‑86510) for the D‑Link DIR‑822A, but provides no additional details about PoC, exploit code, active exploitation, patches, or technical specifics.

Orion84@Orion84xDisclosure

The text discloses CVE-2026-86510, a critical flaw in the L2TP parser of a network device, and advises its use only in untrusted guest or small-office Wi-Fi environments.