Dir 822A
Monthly
Out-of-bounds write in D-Link DIR-822A firmware A_101 allows network-reachable authenticated attackers to corrupt memory and likely achieve remote code execution by sending a crafted L2TP control message with a malformed Host Name AVP to the vulnerable tunnel_set_params function. A public proof-of-concept demonstrating the specific Host Name AVP overflow has been published on Notion, substantially lowering the exploitation barrier. No vendor-released patch has been identified at time of analysis, leaving affected devices exposed without a direct remediation path.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.
Out-of-bounds write in D-Link DIR-822A firmware A_101 allows network-reachable authenticated attackers to corrupt memory and likely achieve remote code execution by sending a crafted L2TP control message with a malformed Host Name AVP to the vulnerable tunnel_set_params function. A public proof-of-concept demonstrating the specific Host Name AVP overflow has been published on Notion, substantially lowering the exploitation barrier. No vendor-released patch has been identified at time of analysis, leaving affected devices exposed without a direct remediation path.
Stack-based buffer overflow in the D-Link DIR-822A (firmware A_101) router allows attackers to corrupt memory in the udhcpd DHCP server via an unbounded strcpy in serverpacket.c while parsing TR-111 DHCP Option 125. The exploit writeup and VulDB entry are public (publicly available exploit code exists), and successful exploitation can crash the DHCP service or achieve code execution on the device. No confirmed active exploitation (not in CISA KEV), but a working POC lowers the bar for opportunistic use against reachable devices.