D-Link has issued a security warning regarding two critical vulnerabilities found in its DIR-822A Wi-Fi routers. The flaws were reported by an external researcher who also released proof-of-concept exploit code for both issues.
The first vulnerability, identified as CVE-2026-86296, is a stack-based buffer overflow in the DHCP server component. It allows remote attackers within the same local network to trigger a crash or execute arbitrary code without authentication.
The second flaw, CVE-2026-86510, involves an out-of-bounds write error. This vulnerability affects devices configured for WAN connections via L2TP or L2TPv6 and requires basic privileges to exploit for memory corruption.
D-Link is currently investigating both issues and developing patches. Although the devices are considered legacy, the company continues to provide support for them.
The vendor advises users to restrict remote access to router management panels and ensure devices are protected by firewalls to prevent unauthorized external connections.
