A vulnerability was determined in D-Link DIR-822A A_101.

CVE-2026-86296 is a stack-based buffer overflow in the DHCP daemon (udhcpcd) on D-Link DIR-822A routers running firmware version A_101. The vulnerable strcpy call in udhcpcd/serverpacket.c copies attacker-controlled data from DHCP option 125 (TR-111 vendor-specific subfields) into a fixed 256-byte stack buffer without bounds checking. An unauthenticated attacker on the same LAN segment can send a crafted DHCP packet to corrupt the stack, crash the daemon, and — under unconfirmed conditions — potentially achieve code execution as root. The affected device is a consumer-grade, non-US, SOHO Wi-Fi router that D-Link has declared End of Life. No firmware patch exists or is expected.

The vendor CVSS of 10.0 is a textbook example of a score that is technically defensible in a vacuum but wildly misleading for enterprise defenders. The vector uses AV:N (Network), but DHCP is a Layer 2 broadcast-domain protocol — you must be on the same local segment to deliver the malicious packet. The correct attack vector is AV:A (Adjacent Network). Even correcting to AV:A still yields a 9.6 base score, but the real-world severity plummets further: the DIR-822A is a $30 consumer router that has no business being in a managed enterprise fleet, reliable RCE has not been demonstrated (only DoS is confirmed), and the device is EOL with zero prospect of a vendor fix. For a team managing 10,000 hosts, this CVE is a housekeeping item — find and replace any strays — not a war-room event.

1. Discover and decommission all DIR-822A units immediately — Run an asset discovery sweep (network scan for D-Link OUI 00:AD:24, 28:EE:52, FC:75:16; SNMP/UPnP device fingerprinting; wireless survey for DIR-822A SSIDs). Any units found should be physically removed and replaced with supported hardware. Since this is a MEDIUM verdict with no mitigation SLA, go straight to the 365-day noisgate remediation window — but given the device is EOL with no patch, replacement is the only action and should be prioritized in your next hardware refresh cycle.
2. Enable DHCP snooping on all managed switches — DHCP snooping on enterprise switches will drop DHCP traffic from untrusted ports, preventing rogue DHCP packets from reaching any DIR-822A units on managed segments. This is a defense-in-depth measure that also protects against DHCP-based attacks on other devices.
3. Enforce 802.1X / NAC on all switch ports — Network Access Control prevents unauthorized devices (including rogue consumer routers) from connecting to enterprise LAN segments. This blocks the attacker's prerequisite of LAN adjacency on managed network segments.
4. Segment any remaining consumer devices behind a quarantine VLAN — If immediate removal is not feasible, isolate DIR-822A units in a dedicated VLAN with no access to production resources. Apply strict ACLs to limit lateral movement from the quarantine segment.

Run this script from any Linux/macOS host on the same network segment as the suspected DIR-822A device. Pass the target router's IP as the first argument: sudo bash check_dir822a.sh 192.168.0.1. Requires curl or wget and nmap (for UPnP fingerprinting). No authentication needed — the script probes UPnP and HTTP headers to identify the device model and firmware.

#!/usr/bin/env bash
# check_dir822a.sh — Detect D-Link DIR-822A with vulnerable firmware A_101
# Usage: sudo bash check_dir822a.sh <router-ip>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:?Usage: $0 <router-ip>}"
VULN_MODEL="DIR-822A"
VULN_FW="A_101"

echo "[*] Checking $TARGET for D-Link DIR-822A (CVE-2026-86296)..."

# Method 1: HTTP server header / body fingerprinting
HTTP_RESP=$(curl -skL --max-time 10 "http://$TARGET/" 2>/dev/null || true)

if echo "$HTTP_RESP" | grep -qi "DIR-822A"; then
    echo "[+] HTTP fingerprint: DIR-822A detected"
    MODEL_FOUND=true
else
    MODEL_FOUND=false
fi

# Method 2: UPnP SSDP fingerprinting
if command -v nmap &>/dev/null; then
    UPNP_RESP=$(nmap -sU -p 1900 --script=upnp-info "$TARGET" 2>/dev/null || true)
    if echo "$UPNP_RESP" | grep -qi "DIR-822A"; then
        echo "[+] UPnP fingerprint: DIR-822A detected"
        MODEL_FOUND=true
    fi
fi

# Method 3: Check HNAP endpoint (D-Link specific)
HNAP_RESP=$(curl -skL --max-time 10 "http://$TARGET/HNAP1/" 2>/dev/null || true)
if echo "$HNAP_RESP" | grep -qi "DIR-822A"; then
    echo "[+] HNAP fingerprint: DIR-822A detected"
    MODEL_FOUND=true
    # Try to extract firmware version from HNAP
    FW_VER=$(echo "$HNAP_RESP" | grep -oiP '(?<=<FirmwareVersion>)[^<]+' || true)
    if [ -n "$FW_VER" ]; then
        echo "[*] Firmware version reported: $FW_VER"
    fi
fi

if [ "$MODEL_FOUND" = true ]; then
    # Check for firmware version A_101
    if echo "$HTTP_RESP $HNAP_RESP" | grep -qiE "A_101|A1\.01|1\.01"; then
        echo ""
        echo "==> VULNERABLE"
        echo "    Device: D-Link DIR-822A firmware A_101"
        echo "    CVE: CVE-2026-86296 (stack-based buffer overflow in udhcpcd)"
        echo "    Status: End of Life — no patch available. Replace this device."
        exit 1
    else
        echo ""
        echo "==> VULNERABLE (assumed)"
        echo "    Device: D-Link DIR-822A detected but firmware version could not be confirmed."
        echo "    All DIR-822A units are EOL and should be replaced regardless of firmware."
        exit 1
    fi
else
    # Check if it's any D-Link device
    if echo "$HTTP_RESP $HNAP_RESP $UPNP_RESP" | grep -qi "D-Link\|dlink"; then
        echo ""
        echo "==> PATCHED (not a DIR-822A)"
        echo "    Device appears to be a D-Link product but not the affected DIR-822A model."
        exit 0
    else
        echo ""
        echo "==> UNKNOWN"
        echo "    Could not fingerprint device at $TARGET as D-Link DIR-822A."
        echo "    Verify manually or check MAC OUI against D-Link prefixes (00:AD:24, 28:EE:52, FC:75:16)."
        exit 2
    fi
fi

1. BleepingComputer — D-Link warns of max severity zero-day bug in DIR-822A routers
2. anoymask — Pre-authentication DHCP Buffer Overflow PoC writeup
3. GBHackers — D-Link DIR-822A Router Vulnerability Scores CVSS 10.0
4. D-Link Support Announcement — Legacy Routers End of Life
5. SecurityOnline — D-Link DIR-822A Vulnerabilities Details and PoC Disclosed
6. CyberSecurityNews — D-Link Router Hit by CVSS 10.0 Flaw
7. VulDB — CVE-2026-86296 Entry
8. GovInfoSecurity — D-Link Flags Max Severity Zero-Day in Legacy Router