EUVD-2026-87816
GHSA-87gr-9jjp-5f3j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router L2TP control endpoint
-
DeliverySend crafted Host Name AVP
-
ExploitTrigger out-of-bounds write in tunnel_set_params
-
ExecutionCorrupt adjacent memory
-
ImpactCrash device or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target D-Link DIR-895L (firmware A1_102b07) to have its L2TP control-channel service reachable by the attacker, and requires sending a crafted L2TP control message whose Host Name AVP triggers the out-of-bounds write in tunnel_set_params. Limiting factors: the L2TP endpoint must be exposed to the attacker's network path (WAN-side exposure is often not default on consumer routers), the vendor vector marks PR:L implying some authentication or authenticated tunnel context may be needed (not independently confirmed), and the vulnerability is specific to the DIR-895L A1 hardware and this firmware build. The product is a discontinued model, so an official fix may be unavailable. |
| Impact | The vendor-supplied CVSS 4.0 vector (8.6, AV:N/AC:L/AT:N/PR:L/UI:N with full VC/VI/VA:H and subsequent-system SC/SI/SA:H) is VulDB-generated and reads as inflated - the SC/SI/SA:H subsequent-system impact implies a scope change to a separate system that an in-process out-of-bounds write on a single router does not clearly justify. The core signal is credible: a CWE-787 out-of-bounds write in the L2TP control-channel parser (tunnel_set_params, Host Name AVP) is a genuine memory-corruption primitive that can yield denial of service and plausibly remote code execution on the device. Exploitation status is 'publicly available exploit code exists' (a write-up/PoC is published on a notion.site page and referenced by VulDB); there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active in-the-wild exploitation - treat this as opportunistically exploitable rather than confirmed weaponized. The privilege field is the key ambiguity: the vendor marks PR:L, but the description ('attack may be initiated remotely') does not confirm whether L2TP control packets can be sent pre-authentication - verify with vendor whether the L2TP endpoint is exposed and authenticated. Net: a real, PoC-backed memory-corruption bug on an end-of-life consumer router, but real-world priority is bounded by the product's limited and declining footprint and the likely non-availability of a vendor patch. |
| Exploit ScenarioDerived | An attacker able to reach the router's L2TP endpoint sends a crafted L2TP control message with a malformed Host Name AVP, driving an out-of-bounds write in tunnel_set_params. A public write-up/PoC exists, so triggering the corruption is straightforward; the outcome is at minimum a device crash/reboot (DoS) and potentially attacker-controlled code execution on the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 27, 2026
An out-of-bounds write in the L2TP control-channel parsing routine (tunnel_set_params in tunnel.c) of D-Link DIR-895L firmware A1_102b07 lets a remote attacker corrupt memory by sending a crafted L2TP control message containing a malformed Host Name AVP. The vendor's CVSS 4.0 score of 8.6 reflects a network-reachable, low-complexity attack requiring low privileges (PR:L), and VulDB has published a public proof-of-concept write-up, so publicly available exploit code exists. Note that the vendor vector's subsequent-system (SC/SI/SA:H) clause appears inflated - the flaw is an in-process memory corruption on a single consumer router - and the DIR-895L is a discontinued model, so no vendor patch has been identified.
Earlier versions of this analysis (1)
Out-of-bounds write in the L2TP control channel parser (tunnel_set_params in tunnel.c) of D-Link DIR-895L firmware A1_102b07 allows remote attackers who can deliver L2TP control-channel traffic to the device to corrupt memory via a crafted L2TP Host Name AVP, potentially achieving code execution or causing a denial of service. The primary prerequisite is reachability of the router's L2TP service - typically as a malicious or spoofed L2TP peer, or an on-path attacker - and the L2TP tunnel/WAN feature must be in use. Publicly available exploit code exists; the CVSS 4.0 vector indicates PR:L, though the independent assessment notes this privilege requirement is not clearly justified for a pre-session packet parser, and there is no CISA KEV listing confirming active exploitation.
RemediationAI
No vendor-released patch has been identified at time of analysis, and because the DIR-895L is a discontinued model, D-Link is unlikely to issue firmware for it; treat replacement with a supported router as the only durable fix. Until then, the effective compensating controls are to disable the L2TP server and L2TP/IPsec pass-through in the router's web administration interface if they are not required (side effect: client VPN tunnels through the device stop working) and to block inbound L2TP and IPsec traffic at the network edge - UDP 1701 for L2TP, plus UDP 500/4500 and ESP (protocol 50) if IPsec transport is bundled - so the crafted Host Name AVP can never reach tunnel_set_params (side effect: legitimate remote VPN access is also blocked). If any remote-administration or WAN-facing management interface is enabled, disable it and restrict router administration to the LAN, since exploitation requires the L2TP control channel to be reachable over the attacker's network path; where filtering is impossible, place the device behind a firewall that performs L2TP deep packet inspection and normalize or drop malformed AVPs. None of these controls repair the underlying memory-safety defect, so they must be paired with a hardware migration plan; monitor the VulDB entries noted above for any late vendor response.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the L2TP control-channel parser of the D-Link DIR-895L, an end-of-life consumer router. L2TP (RFC 2661/3931) control messages are composed of AVPs (Attribute-Value Pairs); the Host Name AVP, which carries a variable-length string, is processed in tunnel_set_params in tunnel.c without adequate bounds validation. Supplying a Host Name AVP whose length or content exceeds the destination buffer produces a classic out-of-bounds write (CWE-787), which in a single-threaded embedded binary of this type typically leads to memory corruption and potentially attacker-influenced control flow. The CPE cpe:2.3:a:d-link:dir-895l:*:*:*:*:*:*:*:* does not pin a firmware revision, but the reported affected build is A1_102b07 on the A1 hardware revision. The published exploit write-up specifically targets the L2TP Host Name AVP path, confirming the sink. The vendor-supplied CVSS 4.0 vector marks PR:L, implying that some authenticated tunnel context or adjacent privilege may be required before the crafted AVP is processed; this prerequisite is plausibly a pre-established L2TP tunnel/session rather than router administrative login, but it has not been independently confirmed from the available data.
Know when Dir 895L gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable L2TP parser with an OOB-write memory-corruption primitive gives high C/I/A on the device; PR:L follows the vendor marking, and scope stays unchanged (S:U) as impact is within the router.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may be used.
Technical POC Analysis
Evidence caveat (read first): the sole cited source (tzh00203.notion.site/...) returned only Notion's "JavaScript must be enabled" stub.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
D-Link DIR-895L routers running firmware A1_102b07, which are discontinued and may remain in branch or remote-office environments, contain a high-severity memory-corruption flaw that can be triggered remotely over the network by an authenticated low-privilege attacker. Publicly available exploit code exists, and No vendor-released patch identified at time of analysis. Because these devices often sit at the network edge, a successful compromise could bypass perimeter controls and expose internal systems, making inventory, isolation, and replacement a leadership-level priority.
No vendor-released patch identified at time of analysis. Interim mitigations: disable L2TP/VPN services on affected DIR-895L firmware A1_102b07 devices where possible; block external L2TP traffic at the firewall; isolate the device on a segmented VLAN with restrictive egress rules; restrict management access to trusted networks; monitor for exploitation attempts and replace the discontinued device as soon as feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Stack-based buffer overflow in D-Link DIR-895L router (firmware A1_102b07) affects the udhcpcd DHCP server daemon's send
Command injection in the D-Link DIR-895L router's DHCP server daemon allows a network-adjacent attacker to execute arbit
Exploit-DB