Defending DIR-822A Deployments Against CVE-2026-86510 Without a Vendor Patch

Vulnerability overview

CVE-2026-86510 is an out-of-bounds write in the L2TP control message parser of the D-Link DIR-822A
router, rated 9.9. It affects firmware A_101 and was disclosed with functional proof-of-concept
code. D-Link has not released a patched firmware; its published position is that it is reviewing the
vulnerability, the affected product scope, and remediation options. A companion bug in the same
firmware, CVE-2026-86296, is a 10.0 stack overflow in the DHCP server.

Mechanism and exploitation conditions

The write occurs in tunnel_set_params, which stores parameters from an L2TP control message into
the device's tunnel state. Because the function does not validate field lengths against the
destination structure, an oversized field overruns the buffer and corrupts adjacent memory.
Exploitation requires the attacker to deliver L2TP control traffic to the daemon. In most
deployments that means local network access. The companion DHCP overflow is more accessible still,
since DHCP traffic is unauthenticated by design and any LAN host can send it.

Impact

The two bugs together cover a wide range of outcomes: crashes and service disruption from either
flaw, and potential code execution from either if the memory corruption can be controlled. A router
that falls to either bug gives an attacker a position to observe traffic, intercept it, and pivot
into the local network. That is the reason to treat this as an operational problem rather than a
patch-management footnote.

Affected products and scope

Confirmed affected: D-Link DIR-822A, firmware A_101. The vendor review is ongoing, so the scope may
change. No other model has been confirmed affected, and none has been confirmed unaffected.

Exposure context

ZoomEye returned 624 assets for the model title query title="DIR-822" and 6,697,454 assets for the broader vendor fingerprint app="D-Link". The vendor-wide number says nothing about which firmware is installed, so the model-specific count is the figure worth quoting. Even that number only proves that DIR-822 family devices are reachable from the internet or a scanned network; it does not prove that any of them are exploitable.

Remediation and mitigations

Since no patch exists, defense is architectural:

Disable remote management on the WAN interface so the device is not administrable from outside.
Put the administration interface on a segment that untrusted and guest devices cannot reach.
Limit which hosts can send traffic to the router's management and protocol services.
Inventory affected devices so a future patch can be applied quickly.
Track D-Link's security publication page, and plan replacement if the model is retired unpatched.