D-Link DIR-895L CVE-2026-86509

Exploitation requires the attacker to be on the same Layer-2 broadcast domain as the DIR-895L router - same LAN segment, same VLAN, or connected to the router's wireless network. The attacker must be able to send DHCP packets (UDP port 67) to the router. No authentication or credentials are required. The udhcpd DHCP server service must be running, which is the factory default configuration on this device. The specific trigger is a DHCP request packet carrying a malformed TR-111 Option 125 (vendor-specific information) field. Exploitation is not directly possible from the internet without first gaining LAN access via a separate vulnerability or physical/network proximity. The Layer-2 adjacency requirement is the primary factor limiting exploitation scale relative to the raw CVSS impact scores.

The CVSS 4.0 base score of 8.6 with E:P (exploit publicly available) accurately reflects meaningful risk given the public PoC. The AV:A (adjacent network) constraint is the primary limiting factor - exploitation requires Layer-2 network presence, meaning internet-based opportunistic attackers cannot directly trigger this flaw without first obtaining a LAN foothold. No authentication is required (PR:N), and the flaw is in the default DHCP service. The SC:H/SI:H/SA:H subsequent-system impact metrics reflect that full router compromise gives an attacker complete control over LAN routing, DNS, and traffic interception. The absence of a vendor patch substantially elevates real-world risk, particularly given that this is a legacy consumer device unlikely to receive a firmware fix. EPSS data was not provided in the input. The combination of public PoC, no patch, and AV:A scope makes this a realistic priority for defenders who have DIR-895L A1 devices on their networks, even though the adjacency requirement prevents mass internet-scale exploitation.

An attacker with access to the same local network as the DIR-895L - via a compromised LAN host, rogue wired connection, or unauthorized wireless access - sends a crafted DHCP discovery packet containing a malformed TR-111 Option 125 payload with an oversized vendor-specific information field. The udhcpd daemon's sendOffer() function processes the option without adequate bounds checking, overflowing a stack buffer and overwriting the saved return address. Upon function return, execution redirects to attacker-controlled code, achieving arbitrary code execution as the DHCP daemon process. The published Notion writeup confirms this exploitation path is documented and reproducible.