EUVD-2026-72336
GHSA-f64f-9c4r-2xmc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin router LAN/Wi-Fi segment
-
DeliveryCraft DHCP packet with oversized Option 125
-
ExploitSend to udhcpd server
-
ExecutionOverflow stack buffer in serverpacket.c
-
PersistOverwrite return address
-
ImpactExecute code or crash DHCP service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to send a malicious DHCP packet to the DIR-822A's udhcpd server, which practically means being on the same local/adjacent network segment (wired LAN or Wi-Fi, including guest/open networks) since DHCP is a link-local service - it is not routable across the internet by default. No authentication to the router's web interface is needed (PR:N) and no user interaction is required (UI:N), but the limiting factor is network position: an attacker must first reach the LAN, so devices with locked-down, WPA-protected Wi-Fi and no untrusted wired access are substantially harder to attack. The specific trigger is a crafted TR-111 DHCP Option 125 field long enough to overflow the fixed stack buffer in serverpacket.c on firmware A_101. |
| Impact | The vendor CVSS 4.0 base is 9.3 with AV:N/AC:L/PR:N/UI:N and full high impact including subsequent-system scope (SC/SI/SA:H), which overstates the real profile in two ways. First, udhcpd is the LAN-side DHCP server, so a crafted DHCP packet realistically requires network-adjacent (broadcast/local segment) access rather than arbitrary internet routability - closer to AV:A than AV:N - meaning an attacker typically must already be on the wireless/wired LAN. Second, an overflow contained within the router's own firmware does not cross a security boundary into a separate system, so the subsequent-system SC/SI/SA:H metrics are not justified. That said, the flaw is genuinely serious: it is unauthenticated, requires no user interaction, a public POC exists, and a mid-sized operator running these consumer routers on trusted-but-open LANs should treat a reachable, exploitable DHCP overflow as urgent rather than theoretical. EPSS was not supplied and the CVE is not KEV-listed, so prioritize based on exposure (guest/wireless network reachability) rather than assuming mass exploitation. |
| Exploit ScenarioDerived | An attacker who has joined the router's LAN - for example via an open or weakly-secured guest Wi-Fi network - sends a crafted DHCP request containing an oversized TR-111 Option 125 field. udhcpd copies the option into a fixed stack buffer with strcpy, overflowing it and overwriting the return address, crashing the DHCP service or executing attacker-supplied code on the router. A public POC/writeup describing the Option 125 parsing overflow is available, reducing the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 07, 2026
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
Earlier versions of this analysis (1)
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) udhcpcd daemon allows attackers to corrupt stack memory via an unbounded strcpy in serverpacket.c while parsing TR-111 Option 125 data in DHCP packets. Successful exploitation can lead to arbitrary code execution or a crash of the DHCP service on the router. Publicly available exploit code exists (VulDB and a third-party Notion writeup); no confirmed active exploitation.
RemediationAI
No vendor-released patch identified at time of analysis; the DIR-822A is an older consumer model and may be end-of-support, so check https://www.dlink.com/ and D-Link security bulletins for a fixed firmware image and apply it if published. As compensating controls, restrict who can reach the DHCP service: isolate untrusted clients (guest Wi-Fi, IoT) onto a separate VLAN/SSID that does not share the DHCP server, disable open/guest wireless where feasible (trade-off: loss of guest access), and enforce Wi-Fi authentication (WPA2/WPA3) so unauthenticated attackers cannot join the LAN segment where udhcpd is reachable. Where a static-lease or upstream DHCP relay architecture is acceptable, minimizing reliance on the on-device udhcpd reduces exposure. If the device is retired or unpatched, plan replacement with a supported router, as embedded DHCP overflows are difficult to mitigate on the host itself.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is udhcpd, the lightweight DHCP server used in embedded Linux/BusyBox-style firmware on the DIR-822A. The root cause is CWE-121 (stack-based buffer overflow): a fixed-size stack buffer is filled with a strcpy() call in serverpacket.c that copies attacker-controlled DHCP option data - specifically the TR-111 Vendor-Identifying Vendor-Specific Information (Option 125) - without validating its length. Because the DHCP server processes client-supplied packets, an oversized option field overruns the stack frame, overwriting the saved return address and adjacent locals. CPE cpe:2.3:a:d-link:dir-822a identifies the affected product; the EUVD entry constrains the affected build to DIR-822A A_101.
Know when Dir 822A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
DHCP is a link-local service so AV:A not AV:N; unauthenticated and no interaction (PR:N/UI:N); stack overflow yields RCE/crash with full single-system impact and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Articles & Coverage 2
Technical POC Analysis
Bug class: CWE-121, stack-based buffer overflow.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
D-Link DIR-822A routers (firmware A_101) contain a critical vulnerability with publicly available exploit code that allows attackers to crash or remotely control affected devices without authentication. Organizations relying on these routers face immediate risk of service disruption and network infrastructure compromise. Urgent action is required to identify affected devices and implement protective measures.
No vendor-released patch identified at time of analysis. Implement these interim mitigations: (1) segment affected routers to limit DHCP exposure to trusted networks only, (2) monitor DHCP traffic for malformed packets and configure rate limiting on suspicious traffic patterns, (3) restrict out-of-band management access and enforce strong authentication on administrative interfaces, (4) maintain frequent configuration backups, (5) prioritize replacement with alternative vendors or newer models. Continuous monitoring and strict access controls are essential until remediation is complete.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB