CVE-2026-96891— D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write
Quick assessment
Affected
D-Link DIR-825
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 D-Link DIR-825 3.00b32 版本中发现了一个漏洞。受影响的函数是位于 文件中的 ，该文件属于 rp-l2tp 组件。对参数 的操控会导致越界写入。攻击者可以远程发起此攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96891
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname leads to out-of-bounds write. The attack may be initiated remotely.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-96891
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96891
请登录查看更多情报信息。
Vendor Pages for CVE-2026-96891 (1)
Other References for CVE-2026-96891 (1)
-
🔗 tzh00203.notion.site related
IV. Related Vulnerabilities
Same product: DIR-825
-
CVE-2026-7069
D-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer ov -
CVE-2026-7068
D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow -
CVE-2026-4627
D-Link DIR-825/DIR-825R NTP Service libdeuteron_modules.so h -
CVE-2025-10666
D-Link DIR-825 apply.cgi sub_4106d4 buffer overflow -
CVE-2025-10034
D-Link DIR-825 httpd ping6_response.cg get_ping6_app_stat bu
Same vendor: D-Link
-
CVE-2026-100740
D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_par -
CVE-2026-95675
D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management -
CVE-2026-94089
D-Link DIR-868L Authentication webfa_authentication.cgi strc -
CVE-2026-94050
D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_k -
CVE-2026-94036
D-Link DIR-X1860/DIR-X1860Z routerd ubus access control
Same weakness: CWE-787
-
CVE-2026-100888
Trusted Domain Project OpenDKIM DKIM Signature Header Select -
CVE-2026-100740
D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_par -
CVE-2026-100504
Ghidra through 12.1.4 Stack-based Buffer Overflow via leftsh -
CVE-2026-80431
Out-of-bounds write in the kitty text sizing protocol allows -
CVE-2026-87118
Botslab G980H Dashcams Out-of-bounds Write
V. Comments for CVE-2026-96891
No comments yet