D-Link DIR-822A EUVD-2026-72609

The DIR-822A must have its L2TP server component active and UDP port 1701 reachable from the attacker's network position. The CVSS 4.0 vector specifies PR:L, indicating that some low-privilege authentication or L2TP protocol-level credential is required before the vulnerable tunnel_set_params code path is reached; the precise threshold (e.g., shared L2TP secret or ISP PPPoE credential) is not fully described in available sources. No special timing or race condition is required (AC:L, AT:N). Exploitation is blocked for devices where the L2TP server is disabled, where port 1701 is filtered at a perimeter firewall, or where firmware version differs from A_101.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 8.6) captures the core risk posture: network-reachable, low complexity, low-privilege threshold, no user interaction required. The impact metrics VC:H/VI:H/VA:H and the scope-change metrics SC:H/SI:H/SA:H reflect that full router compromise at the network gateway position cascades to all traffic and downstream devices. The exploit maturity modifier E:P confirms a public PoC exists, which was independently verified through the Notion writeup linked in the references. No active exploitation appears in the CISA KEV, and EPSS data is not available in the provided sources, so widespread automated exploitation has not been confirmed - but the PoC lowers the bar substantially for any motivated actor. Even a mid-sized municipal IT team in leszno managing SOHO-class routers should treat this as a priority given both the gateway-position blast radius and the ready availability of working exploit code. The absence of a vendor patch compounds the risk, as no direct remediation exists and the device may be approaching end-of-support.

An attacker with network access and low-level L2TP credentials sends a crafted SCCRQ control message to the DIR-822A's L2TP listener containing an oversized Host Name AVP, triggering an out-of-bounds write in tunnel_set_params that corrupts adjacent memory and redirects firmware execution. A public proof-of-concept demonstrating this exact Host Name AVP overflow vector has been published, meaning an attacker with basic technical skill can replicate the exploit without original research. Successful exploitation would grant full control of the router, enabling persistent firmware implants, traffic interception, or use of the device as a pivot point into connected networks.