D-Link DIR-895L CVE-2026-86295

Exploitation requires the attacker to be on a network segment served by the DIR-895L's DHCP server (i.e., LAN-adjacent), enabling them to send a DHCP REQUEST packet. No authentication is required - any device capable of sending DHCP packets can trigger the vulnerability. The DHCP server must be active (its default state on this router). If the attack additionally relies on the TR-069 Host Helper pathway (as suggested by the PoC title), TR-069 WAN management must be enabled and reachable from the attacker's vantage point, which is a non-default exposure for most home deployments. The vulnerability is limited to firmware version A1_102b07 as confirmed in the description; other firmware versions are unconfirmed as affected or unaffected. The attack is constrained by requiring network adjacency for the DHCP vector, but the low complexity of DHCP packet crafting means any device on the LAN can attempt exploitation.

The provided CVSS 4.0 score of 6.9 with VC:L/VI:L/VA:L appears to significantly understate real-world impact - a successful command injection on a router's DHCP daemon typically yields unauthenticated root access, which would justify C:H/I:H/A:H on the vulnerable system. The AV:N designation in the vendor-supplied CVSS 4.0 vector is questionable: DHCP is a LAN broadcast protocol and under typical deployment, exploitation requires adjacency to the LAN segment; however, the TR-069 Host Helper reference in the PoC raises an unresolved question about whether the WAN interface (via ISP ACS communication) could be leveraged as a second exploitation path. A public PoC exists (E:P confirmed), which meaningfully elevates real-world exploitation probability beyond what the moderate score suggests. No KEV listing at time of analysis, but the combination of unauthenticated network access and public exploit code on an aging consumer router makes this a high-priority finding for any environment still running this device. The DIR-895L A1 is a legacy product likely past D-Link's support lifecycle, making vendor remediation uncertain.

An attacker on the same LAN segment (or potentially via TR-069 WAN management channel) sends a crafted DHCP DISCOVER or REQUEST packet containing a Hostname option with embedded shell metacharacters, such as a backtick or semicolon followed by a command. When the DIR-895L's udhcpcd processes this in sendACK and passes the unsanitized hostname to a system-level helper (referenced in the PoC as a TR-069 Host Helper), the injected command executes with the privileges of the DHCP daemon - typically root on consumer router firmware. A public PoC hosted on Notion demonstrates this technique against firmware A1_102b07.