CVE-2026-86295— D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection
Quick assessment
Affected
D-Link DIR-895L
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 D-Link DIR-895L A1_102b07 中发现了一个漏洞。该漏洞位于组件 中文件 的 函数中。对参数 的处理会导致命令注入漏洞。该攻击可远程触发。利用该漏洞的 PoC（证明概念代码）已公开，可能被利用。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86295
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86295
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86295
请登录查看更多情报信息。
News Coverage for CVE-2026-86295 (1)
-
🔗 CVE-2026-86295 D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection Read full article vdb-entry technical-description
Vendor Pages for CVE-2026-86295 (1)
Other References for CVE-2026-86295 (4)
-
https://vuldb.com/cve/CVE-2026-86295 third-party-advisory
-
-
https://vuldb.com/submit/906296 third-party-advisory
Same Patch Batch · D-Link · 2026-09-07 · 3 CVEs total
| CVE-2026-86296 | 10.0 CRITICAL | D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow |
| CVE-2026-86297 | 8.1 HIGH | D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one |
IV. Related Vulnerabilities
Same vendor: D-Link
-
CVE-2026-86297
D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_para -
CVE-2026-86296
D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based ov -
CVE-2026-85224
D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os -
CVE-2026-85223
D-Link DNS-340L CGI dropbox.cgi os command injection -
CVE-2026-85222
D-Link DNS-340L Add-On Center addon_center.cgi os command in
Same weakness: CWE-77
-
CVE-2026-79698
Advantech WISE-6610-NB Node-RED nodered_lib_apply command in -
CVE-2026-79697
Advantech WISE-6610-NB Basic Station Certificate-Deletion ba -
CVE-2026-53932
wnx/laravel-backup-restore: Improper Neutralization of Speci -
CVE-2026-63694
Dell SmartFabric OS10 Software 命令注入漏洞 -
CVE-2026-79754
Nuclio: Kaniko build tempDir command injection
V. Comments for CVE-2026-86295
No comments yet