CVE-2026-86509— D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow
Quick assessment
Affected
D-Link DIR-895L
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
D-Link DIR-895L是中国D-Link公司的一款高性能无线路由器。 D-Link DIR-895L A1_102b07版本存在缓冲区错误漏洞，该漏洞源于udhcpcd组件中udhcpcd/serverpacket.c文件的sendOffer/sendACK函数存在栈缓冲区溢出，可能导致本地网络攻击者执行任意代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86509
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
D-Link DIR-895L 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
D-Link DIR-895L是中国D-Link公司的一款高性能无线路由器。 D-Link DIR-895L A1_102b07版本存在缓冲区错误漏洞，该漏洞源于udhcpcd组件中udhcpcd/serverpacket.c文件的sendOffer/sendACK函数存在栈缓冲区溢出，可能导致本地网络攻击者执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-86509
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86509
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-86509 (1)
-
🔗 tzh00203.notion.site exploit
Vendor Pages for CVE-2026-86509 (1)
Other References for CVE-2026-86509 (1)
-
🔗 CVE-2026-86509 D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow Read full article vdb-entry technical-description
IV. Related Vulnerabilities
Same vendor: D-Link
-
CVE-2026-113736
D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_ -
CVE-2026-113735
D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credent -
CVE-2026-112146
D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credent -
CVE-2026-110536
D-Link DIR-868L HNAP CGI cgibin system os command injection -
CVE-2026-108971
D-Link DCS-930L Emergency HTTP Recovery Server bootloader_re
Same weakness: CWE-121
-
CVE-2026-115863
ConnMan 2.0 前版本 DHCPv6 栈缓冲区溢出漏洞 -
CVE-2026-53921
odhcpd: Stack buffer overflow in DHCPv6 IA reply serializati -
CVE-2026-96185
Microsoft Exchange Online Remote Code Execution Vulnerabilit -
CVE-2026-85079
Out-of-bounds write in Zigbee Simple_Desc_req handling -
CVE-2026-94502
Out-of-bounds write in Zigbee Publish Price Matrix handling
V. Comments for CVE-2026-86509
No comments yet