CVE-2026-86295: D-Link DIR-895L Router RCE Vulnerability

CVE-2026-86295 Overview

CVE-2026-86295 is a command injection vulnerability affecting the D-Link DIR-895L router running firmware version A1_102b07. The flaw resides in the sendACK function within udhcpcd/serverpacket.c, part of the embedded udhcpcd DHCP server component. Attackers can manipulate the Hostname argument in DHCP traffic to inject arbitrary operating system commands. The vulnerability is exploitable remotely over the network without authentication or user interaction. Public exploit details have been published, increasing the likelihood of opportunistic exploitation against exposed devices. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers can inject arbitrary commands into the router by supplying a crafted DHCP Hostname value, potentially leading to full device compromise on the local network segment.

Affected Products

D-Link DIR-895L router
Firmware version A1_102b07
Embedded udhcpcd DHCP server component

Discovery Timeline

2026-09-07 - CVE-2026-86295 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86295

Vulnerability Analysis

The vulnerability exists in the sendACK function of udhcpcd/serverpacket.c, which handles DHCP ACK packet construction on the D-Link DIR-895L. When a DHCP client requests a lease, the server processes client-supplied options including the Hostname field. The sendACK routine passes this attacker-controlled string into a downstream command execution context without proper neutralization. This allows shell metacharacters embedded in the hostname to break out of the intended argument and execute arbitrary commands on the router. Because DHCP traffic is processed by privileged system daemons, injected commands typically run with elevated permissions on the embedded Linux system.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream component [CWE-74]. The Hostname DHCP option is concatenated into a command string, likely for use in TR-069 host helper or hostname registration logic, without sanitization or use of safe execution APIs. Any client field containing characters such as backticks, semicolons, or $() is interpreted by the shell.

Attack Vector

Exploitation requires the attacker to reach the DHCP service on the router, which is typically bound to the LAN interface. An attacker on the local network sends a crafted DHCP request containing shell metacharacters in the Hostname option. When the router responds with sendACK, the malicious hostname is processed and the injected commands execute. Public analysis of the flaw is available in the Notion command injection write-up and the VulDB entry for CVE-2026-86295.

No verified exploit code is reproduced here. Refer to the linked technical references for proof-of-concept details.

Detection Methods for CVE-2026-86295

Indicators of Compromise

DHCP DISCOVER or REQUEST packets containing shell metacharacters (;, `, $(), |, &) inside Option 12 (Host Name).
Unexpected outbound connections originating from the router itself, such as reverse shells or HTTP downloads.
New or modified files in writable partitions of the router firmware, including /tmp or /var.
Unusual process activity spawned by the udhcpcd daemon.

Detection Strategies

Inspect DHCP traffic at the switch or gateway for hostname options containing non-printable or shell-special characters.
Baseline expected DHCP client hostnames on the network and alert on anomalies.
Monitor router syslog output for unexpected command execution or crashes tied to DHCP transactions.

Monitoring Recommendations

Enable and forward router syslog to a central logging platform for retention and correlation.
Alert on any outbound connections initiated by network infrastructure devices that are not part of normal operations.
Correlate DHCP lease activity with subsequent configuration changes on the router.

How to Mitigate CVE-2026-86295

Immediate Actions Required

Restrict physical and logical access to the LAN segment where the DIR-895L is deployed.
Disable the built-in DHCP server on the DIR-895L if an upstream DHCP server can be used instead.
Segment untrusted devices, including guest Wi-Fi and IoT endpoints, onto isolated VLANs that cannot reach the router's DHCP service.
Audit connected clients and remove unknown devices from the network.

Patch Information

No vendor patch has been referenced in the published advisory data for CVE-2026-86295. The DIR-895L has reached end-of-support status in several regions. Consult the D-Link official website for the latest firmware status and consider replacing end-of-life hardware with a currently supported model.

Workarounds

Replace the affected DIR-895L with a supported router that receives active security updates.
Place the router behind a firewall or access control list that restricts DHCP traffic to known MAC addresses.
Use network access control (NAC) to authenticate clients before they can send DHCP requests.
Monitor DHCP traffic and drop packets where Option 12 contains shell metacharacters at an upstream inspection point.

bash

# Example: block DHCP hostname options containing shell metacharacters
# using an inline netfilter rule on an upstream Linux gateway
iptables -A FORWARD -p udp --dport 67 \
  -m string --algo bm --hex-string '|3B|' --from 240 \
  -j DROP