D-Link has confirmed it is investigating two critical vulnerabilities affecting the DIR-822A A_101 router, one of which reaches the maximum possible severity score on the CVSS scale.
What Happened
The first flaw, tracked as CVE-2026-86296, is a stack-based buffer overflow (CWE-121) combined with improper restriction of operations within memory bounds (CWE-119). Its CVSS v3.1 vector shows the bug can be triggered over the network, needs no special access complexity, requires no credentials, and needs no interaction from a victim — a combination that pushes the score to a perfect 10.0. A public proof-of-concept for this flaw has already been published.
The second, CVE-2026-86510, is an out-of-bounds write in the tunnel_set_params function of the router's L2TP control-message parser. It carries a CVSS v3.1 score of 9.9 (9.4 under CVSS v4.0). Unlike the first bug, exploitation requires low privileges, though it still needs no interaction from a user — an attacker who can reach the parser could send specially crafted L2TP control messages to corrupt memory. A public proof-of-concept has been reported for this issue as well.
D-Link says it is still validating which hardware revisions and regions are affected, and has not yet confirmed a firmware remediation timeline for either issue.
Why It Matters
Both bugs can compromise confidentiality, integrity, and availability of the device. The risk is highest for routers whose administration interface is reachable directly from the public internet — no credentials or user action are needed to attempt exploitation of CVE-2026-86296, and the presence of a public PoC materially raises the odds that scanning and exploitation attempts follow quickly. Organizations and home users running the affected model should treat this as an active exposure-management issue rather than wait for a patch before acting.
What to Do
- Identify whether you're running a DIR-822A — check the exact model, hardware revision, and installed firmware version, since D-Link's remediation guidance is revision-specific.
- Never expose the router's administration interface directly to the internet.
- Disable remote management unless it is strictly required.
- Restrict administrative access to trusted internal systems only.
- Watch your regional D-Link support portal for firmware updates or further guidance, and apply only the image matched to your exact hardware revision — installing the wrong image can damage the device or leave it unprotected.