EUVD-2026-85781
GHSA-3hcq-2p28-7753
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach L2TP service over network
-
DeliverySend crafted Host-Name AVP
-
ExploitTrigger out-of-bounds write in tunnel_set_params
-
ExecutionCorrupt adjacent memory
-
ImpactExecute code or crash daemon
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the router's rp-l2tp (L2TP) service to be network-reachable by the attacker; the crafted input is an oversized/malformed peer_hostname (L2TP Host-Name AVP) processed by tunnel_set_params. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required. The primary limiting factor is whether L2TP is enabled and exposed (WAN-facing) on a given DIR-825 3.00b32 deployment - if L2TP is disabled or firewalled, the attack surface is not reachable; the specific legacy firmware build (3.00b32) is also required. |
| Impact | The vendor CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), describing a remote, unauthenticated, low-complexity out-of-bounds write (CWE-787) in the rp-l2tp component's tunnel_set_params handling of the peer_hostname (L2TP Host-Name AVP). If the L2TP service is network-reachable, this is a high-priority memory-corruption flaw that can plausibly lead to code execution or crash of the router. However, several signals temper the raw score: no EPSS probability is provided, the CVE is NOT on CISA KEV (no confirmed active exploitation), and the only exploitation evidence is a public technical writeup (Notion) rather than KEV telemetry. Reachability is the key open question - L2TP is typically a WAN/VPN-facing service, and whether it is exposed by default on the DIR-825 is not confirmed by the input, which materially affects whether PR:N/AV:N is realistic in practice. The affected build (DIR-825 3.00b32) is a legacy consumer router, and D-Link legacy models are frequently end-of-life without patches, so remediation may be unavailable. Net: a genuinely severe bug class on an exposed service, but real-world priority is bounded by uncertain default exposure and the niche/legacy footprint of the specific device. |
| Exploit ScenarioDerived | An attacker sends a crafted L2TP control packet containing an oversized or malformed Host-Name AVP to the router's rp-l2tp service, causing tunnel_set_params to write past a buffer boundary and corrupt memory. Given the network attack vector with no authentication or user interaction, this could crash the L2TP daemon or, if the overwrite is controllable, achieve remote code execution. A public technical writeup detailing the out-of-bounds write exists, lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Out-of-bounds write in the rp-l2tp component of D-Link DIR-825 firmware 3.00b32 allows a remote, unauthenticated attacker to corrupt memory by sending a crafted L2TP Host-Name AVP, with the CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity, and availability impact. The flaw resides in tunnel_set_params() in tunnel.c, where the peer_hostname argument is copied without adequate bounds validation, so an oversized or malformed value overwrites adjacent memory; because the vulnerable code sits in the L2TP tunnel setup path, an attacker only needs network reachability to the router's L2TP service and no credentials or user interaction. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the severity and low attack complexity make the exposure significant for any deployment that leaves L2TP enabled on a WAN-facing interface.
RemediationAI
No vendor-released patch was identified at time of analysis for CVE-2026-96891, so remediation must initially rely on reducing the attack surface rather than upgrading. The most effective control is to disable the L2TP service (rp-l2tp) on the DIR-825 if it is not actively required; doing so removes the vulnerable code path entirely but breaks any legitimate L2TP VPN tunnels terminating on the device. If L2TP must remain enabled, restrict access to the L2TP control plane by blocking UDP port 1701 inbound at the WAN boundary and allowing it only from explicitly trusted peer IP addresses, accepting the trade-off that mobile or roaming clients with dynamic addresses will be unable to connect. Administrators should also verify that the router's WAN-facing services are not unnecessarily exposed, disable remote administration, and isolate the device on a segmented network segment so that a successful compromise cannot pivot into other assets. Given the age of the 3.00b32 firmware and the likely end-of-support status of this hardware revision, replacing the DIR-825 with a currently supported router is the most durable fix; until then, monitor the vendor page at https://www.dlink.com/ and the VulDB advisory at https://vuldb.com/vuln/409134 for any firmware update or updated guidance. No public exploit code was identified at time of analysis, but the low attack complexity and unauthenticated network vector justify prioritizing these mitigations wherever L2TP is reachable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component, rp-l2tp, is the Layer 2 Tunneling Protocol (L2TP) implementation used by D-Link DIR-825 firmware, and the vulnerable routine tunnel_set_params() in tunnel.c processes attributes carried in incoming L2TP control messages during tunnel establishment. Specifically, the peer_hostname parameter - populated from the L2TP Host-Name AVP (Attribute Value Pair) - is handled with insufficient length validation, producing a classic CWE-787 out-of-bounds write when the supplied value exceeds the destination buffer, commonly a buffer overflow of this type can lead to adjacent memory corruption and potentially arbitrary code execution or denial of service on the device. The CPE record cpe:2.3:a:d-link:dir-825:*:*:*:*:*:*:*:* confirms the DIR-825 product family is the affected platform, with the specific legacy firmware build 3.00b32 named in the report. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) agree that the attack is network-reachable, low-complexity, unauthenticated, and requires no user interaction, with no scope change. The only practical precondition is that the L2TP/rp-l2tp service be enabled and reachable from the attacker's network position.
Know when Dir 825 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated OOB write reachable over the network via L2TP with no user interaction; memory corruption plausibly yields full code execution, so C/I/A all High.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname leads to out-of-bounds write. The attack may be initiated remotely.
Articles & Coverage 1
Executive ViewAI
D-Link DIR-825 routers running firmware 3.00b32 are exposed to a critical out-of-bounds write flaw in the rp-l2tp component, which could allow a network-adjacent attacker to corrupt memory and potentially gain control of the device. Organizations using these routers for WAN-facing L2TP services face significant risk of network compromise, data breach, and operational disruption, and leadership should prioritize immediate mitigation given the absence of a vendor patch.
No vendor-released patch identified at time of analysis; interim mitigations include disabling L2TP if not required, blocking UDP port 1701 at the network perimeter, restricting L2TP access to trusted IPs, enabling logging and monitoring for anomalous L2TP traffic, and segmenting the router from critical assets.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Buffer overflow in D-Link DIR-825 router's miniupnpd service allows authenticated adjacent network attackers to achieve
An OS command injection vulnerability exists in D-Link DIR-825 and DIR-825R routers running firmware versions 1.0.5 and
Exploit-DB