Which versions of D-Link DIR-605 are affected by CVE-2026-86297?

D-Link DIR-605 B1v202WWB03 routers contain an unauthenticated remote code execution vulnerability in the L2TP protocol handler; publicly available exploit code has been published.

Is there a public PoC exploit available for CVE-2026-86297?

Yes, a public proof-of-concept exploit is available for CVE-2026-86297. Prioritise patching immediately. EPSS: 1.0%.

How to fix or mitigate CVE-2026-86297?

Within 24 hours: scan the network to identify and inventory all D-Link DIR-605 B1v202WWB03 units; implement firewall rules to block inbound L2TP traffic (UDP port 1701) from untrusted networks and disable the L2TP protocol on the router if not operationally required; configure NetFlow-based alerting for L2TP anomalies and exploitation attempts. Within 7 days: contact D-Link support to determine if any interim firmware updates beyond v202WWB03 or security patches are available; begin procurement process for replacement routers from vendors with active security patch support; perform historical network traffic analysis to identify any signs of exploitation. Within 30 days: complete migration to patched replacement equipment or upgrade affected routers to any available D-Link firmware version with documented fixes for this vulnerability.

D-Link DIR-605 CVE-2026-86297

Q: What is the CVSS score of CVE-2026-86297?

CVE-2026-86297 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-72339 HIGH

Off-by-one Error (CWE-193)

2026-09-07 VulDB

GHSA-fwmj-7xm4-cg9r

D-Link Dir 605 D-Link

8.2

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable L2TP parser, unauthenticated, but AC:H for required memory layout precision; full C/I/A on device, no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 07, 2026 - 15:28 vuln.today

Metadata Corrected

Sep 07, 2026 - 11:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 07, 2026 - 11:31 vuln.today

Severity Changed

Sep 07, 2026 - 11:22 NVD

CRITICAL HIGH

CVSS changed

Sep 07, 2026 - 11:22 NVD

9.2 (CRITICAL) 8.2 (HIGH)

CVE Published

Sep 07, 2026 - 10:45 cve.org

HIGH 8.2

DescriptionCVE.org

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.

Articles & Coverage 1

News 4 New D-Link Vulnerabilities - 1 Critical, 3 High, All With POC Sep 08, 2026

AnalysisAI

Off-by-one memory corruption in D-Link DIR-605 B1v202WWB03 allows unauthenticated remote attackers to trigger an out-of-bounds write via a crafted L2TP Host Name AVP in the peer_hostname argument of tunnel_set_params. The flaw resides in the router's L2TP Control Message Parser (progs.gpl/pppd.alpha/l2tp/tunnel.c) and carries full C/I/A impact on the device. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The L2TP service must be active and reachable on the DIR-605 - this is a network-facing daemon typically listening on UDP port 1701. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 8.2, reflecting network-reachable unauthenticated exploitation against a full-compromise impact baseline, but tempered by high attack complexity (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: scan the network to identify and inventory all D-Link DIR-605 B1v202WWB03 units; implement firewall rules to block inbound L2TP traffic (UDP port 1701) from untrusted networks and disable the L2TP protocol on the router if not operationally required; configure NetFlow-based alerting for L2TP anomalies and exploitation attempts. …

Threat intelligence, references, and detailed analysis are available after sign-in.