Which versions of D-Link DIR-895L are affected by CVE-2026-86509?

The D-Link DIR-895L router (firmware A1_102b07) contains a stack-based buffer overflow in its DHCP server daemon that enables remote code execution without requiring authentication.

Is there a public PoC exploit available for CVE-2026-86509?

Yes, a public proof-of-concept exploit is available for CVE-2026-86509. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-86509?

Within 24 hours, conduct a network inventory scan to identify all D-Link DIR-895L routers running firmware A1_102b07 and immediately restrict DHCP traffic from untrusted networks at your perimeter and internal network boundaries; if the device is operationally critical, disable DHCP server functionality and migrate DHCP services to an alternative, patched server. Within 7 days, contact D-Link support to confirm the absence of a firmware patch and document your complete affected-device inventory; simultaneously issue a purchase order for replacement routers from D-Link (latest current models) or alternative vendors with active security update support. Within 30 days, complete the physical replacement or decommissioning of all affected DIR-895L units, migrate DHCP server roles entirely to patched infrastructure, and implement network segmentation policies to prevent legacy devices from servicing critical network functions.

D-Link DIR-895L CVE-2026-86509

Q: What is the CVSS score of CVE-2026-86509?

CVE-2026-86509 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-72608 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-09-08 VulDB

GHSA-xq27-3vwq-mgr2

Buffer Overflow D-Link Stack Overflow Dir 895L D-Link

8.6

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.6 CRITICAL

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Adjacent-network only (AV:A); no credentials needed (PR:N); scope change (S:C) as router compromise enables full LAN traffic interception and manipulation.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 08, 2026 - 11:21 vuln.today

Analysis Generated

Sep 08, 2026 - 01:30 vuln.today

Severity Changed

Sep 08, 2026 - 01:22 NVD

CRITICAL HIGH

CVSS changed

Sep 08, 2026 - 01:22 NVD

9.4 (CRITICAL) 8.6 (HIGH)

CVE Published

Sep 08, 2026 - 00:45 cve.org

HIGH 8.6

DescriptionCVE.org

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.

Articles & Coverage 1

News 4 New D-Link Vulnerabilities - 1 Critical, 3 High, All With POC Sep 08, 2026

AnalysisAI

Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's sendOffer() and sendACK() functions when parsing TR-111 Option 125 vendor-specific data. An adjacent-network unauthenticated attacker can send a crafted DHCP packet to trigger the overflow, potentially achieving arbitrary code execution on the router with daemon-level privileges. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to be on the same Layer-2 broadcast domain as the DIR-895L router - same LAN segment, same VLAN, or connected to the router's wireless network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 8.6 with E:P (exploit publicly available) accurately reflects meaningful risk given the public PoC. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a network inventory scan to identify all D-Link DIR-895L routers running firmware A1_102b07 and immediately restrict DHCP traffic from untrusted networks at your perimeter and internal network boundaries; if the device is operationally critical, disable DHCP server functionality and migrate DHCP services to an alternative, patched server. …

Threat intelligence, references, and detailed analysis are available after sign-in.