What is the CVSS score of CVE-2026-96891?

CVE-2026-96891 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.7%.

How to fix or mitigate CVE-2026-96891?

Within 24 hours, disable the L2TP service on all D-Link DIR-825 devices running firmware 3.00b32 and block UDP port 1701 from untrusted networks at the perimeter firewall; if L2TP is business-critical, restrict access to known trusted IP addresses only. Within 7 days, monitor vendor advisories for a firmware update and apply any patch as soon as released; in the interim, enable logging and intrusion detection for L2TP traffic and conduct a review of all internet-facing D-Link routers to identify additional exposures. Within 30 days, develop a migration plan to replace end-of-life D-Link DIR-825 devices with supported hardware that receives regular security updates, and perform a network segmentation review to limit the blast radius of any future compromise.

D-Link DIR-825 CVE-2026-96891

EUVD-2026-85781 CRITICAL

Out-of-bounds Write (CWE-787)

2026-09-24 VulDB

GHSA-3hcq-2p28-7753

Buffer Overflow Memory Corruption D-Link Dir 825 D-Link

9.3

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach L2TP service over network
Delivery

Send crafted Host-Name AVP
Exploit

Trigger out-of-bounds write in tunnel_set_params
Execution

Corrupt adjacent memory
Impact

Execute code or crash daemon

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the router's rp-l2tp (L2TP) service to be network-reachable by the attacker; the crafted input is an oversized/malformed peer_hostname (L2TP Host-Name AVP) processed by tunnel_set_params. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required. The primary limiting factor is whether L2TP is enabled and exposed (WAN-facing) on a given DIR-825 3.00b32 deployment - if L2TP is disabled or firewalled, the attack surface is not reachable; the specific legacy firmware build (3.00b32) is also required.
Impact	The vendor CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), describing a remote, unauthenticated, low-complexity out-of-bounds write (CWE-787) in the rp-l2tp component's tunnel_set_params handling of the peer_hostname (L2TP Host-Name AVP). If the L2TP service is network-reachable, this is a high-priority memory-corruption flaw that can plausibly lead to code execution or crash of the router. However, several signals temper the raw score: no EPSS probability is provided, the CVE is NOT on CISA KEV (no confirmed active exploitation), and the only exploitation evidence is a public technical writeup (Notion) rather than KEV telemetry. Reachability is the key open question - L2TP is typically a WAN/VPN-facing service, and whether it is exposed by default on the DIR-825 is not confirmed by the input, which materially affects whether PR:N/AV:N is realistic in practice. The affected build (DIR-825 3.00b32) is a legacy consumer router, and D-Link legacy models are frequently end-of-life without patches, so remediation may be unavailable. Net: a genuinely severe bug class on an exposed service, but real-world priority is bounded by uncertain default exposure and the niche/legacy footprint of the specific device.
Exploit ScenarioDerived	An attacker sends a crafted L2TP control packet containing an oversized or malformed Host-Name AVP to the router's rp-l2tp service, causing tunnel_set_params to write past a buffer boundary and corrupt memory. Given the network attack vector with no authentication or user interaction, this could crash the L2TP daemon or, if the overwrite is controllable, achieve remote code execution. A public technical writeup detailing the out-of-bounds write exists, lowering the barrier to weaponization.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Out-of-bounds write in the rp-l2tp component of D-Link DIR-825 firmware 3.00b32 allows a remote, unauthenticated attacker to corrupt memory by sending a crafted L2TP Host-Name AVP, with the CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity, and availability impact. The flaw resides in tunnel_set_params() in tunnel.c, where the peer_hostname argument is copied without adequate bounds validation, so an oversized or malformed value overwrites adjacent memory; because the vulnerable code sits in the L2TP tunnel setup path, an attacker only needs network reachability to the router's L2TP service and no credentials or user interaction. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the severity and low attack complexity make the exposure significant for any deployment that leaves L2TP enabled on a WAN-facing interface.

RemediationAI

No vendor-released patch was identified at time of analysis for CVE-2026-96891, so remediation must initially rely on reducing the attack surface rather than upgrading. The most effective control is to disable the L2TP service (rp-l2tp) on the DIR-825 if it is not actively required; doing so removes the vulnerable code path entirely but breaks any legitimate L2TP VPN tunnels terminating on the device. If L2TP must remain enabled, restrict access to the L2TP control plane by blocking UDP port 1701 inbound at the WAN boundary and allowing it only from explicitly trusted peer IP addresses, accepting the trade-off that mobile or roaming clients with dynamic addresses will be unable to connect. Administrators should also verify that the router's WAN-facing services are not unnecessarily exposed, disable remote administration, and isolate the device on a segmented network segment so that a successful compromise cannot pivot into other assets. Given the age of the 3.00b32 firmware and the likely end-of-support status of this hardware revision, replacing the DIR-825 with a currently supported router is the most durable fix; until then, monitor the vendor page at https://www.dlink.com/ and the VulDB advisory at https://vuldb.com/vuln/409134 for any firmware update or updated guidance. No public exploit code was identified at time of analysis, but the low attack complexity and unauthenticated network vector justify prioritizing these mitigations wherever L2TP is reachable.

Affected VersionsENISA

DIR-825 3.00b32

Affected Packages

euvd dir_825 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component, rp-l2tp, is the Layer 2 Tunneling Protocol (L2TP) implementation used by D-Link DIR-825 firmware, and the vulnerable routine tunnel_set_params() in tunnel.c processes attributes carried in incoming L2TP control messages during tunnel establishment. Specifically, the peer_hostname parameter - populated from the L2TP Host-Name AVP (Attribute Value Pair) - is handled with insufficient length validation, producing a classic CWE-787 out-of-bounds write when the supplied value exceeds the destination buffer, commonly a buffer overflow of this type can lead to adjacent memory corruption and potentially arbitrary code execution or denial of service on the device. The CPE record cpe:2.3:a:d-link:dir-825:*:*:*:*:*:*:*:* confirms the DIR-825 product family is the affected platform, with the specific legacy firmware build 3.00b32 named in the report. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) agree that the attack is network-reachable, low-complexity, unauthenticated, and requires no user interaction, with no scope change. The only practical precondition is that the L2TP/rp-l2tp service be enabled and reachable from the attacker's network position.

Know when Dir 825 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 9.8 CRITICAL

Remote unauthenticated OOB write reachable over the network via L2TP with no user interaction; memory corruption plausibly yields full code execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname leads to out-of-bounds write. The attack may be initiated remotely.

Articles & Coverage 1

News Critical Out-of-Bounds Write in D-Link DIR-825 Firmware rp-l2tp - CVE-2026-96891 Sep 24, 2026

Executive ViewAI

Why It Matters

D-Link DIR-825 routers running firmware 3.00b32 are exposed to a critical out-of-bounds write flaw in the rp-l2tp component, which could allow a network-adjacent attacker to corrupt memory and potentially gain control of the device. Organizations using these routers for WAN-facing L2TP services face significant risk of network compromise, data breach, and operational disruption, and leadership should prioritize immediate mitigation given the absence of a vendor patch.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include disabling L2TP if not required, blocking UDP port 1701 at the network perimeter, restricting L2TP access to trusted IPs, enabling logging and monitoring for anomalous L2TP traffic, and segmenting the router from critical assets.

Threat Intelligence Overview

EPSS Score

0.7%

Top 51% exploitable

Prevalence

Low

legacy D-Link consumer SOHO router model, limited and aging footprint

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.7%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.