CVE-2026-86297 Overview
CVE-2026-86297 is an off-by-one vulnerability affecting the D-Link DIR-605 B1v202WWB03 router. The flaw resides in the tunnel_set_params function within progs.gpl/pppd.alpha/l2tp/tunnel.c, part of the Layer 2 Tunneling Protocol (L2TP) Control Message Parser. Attackers can trigger the condition by manipulating the peer_hostname argument during L2TP control message processing. The issue is remotely exploitable over the network without authentication, though exploitation is considered technically complex. A public exploit is available, increasing the potential for opportunistic attacks against exposed devices.
Critical Impact
Remote attackers can trigger an out-of-bounds write in the L2TP Host Name AVP handler, potentially compromising confidentiality, integrity, and availability of the affected D-Link DIR-605 device.
Affected Products
- D-Link DIR-605 router, firmware version B1v202WWB03
- L2TP Control Message Parser component (pppd.alpha/l2tp/tunnel.c)
- Devices exposing L2TP services to untrusted networks
Discovery Timeline
- 2026-09-07 - CVE-2026-86297 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86297
Vulnerability Analysis
The vulnerability is an off-by-one write condition categorized under [CWE-189] (Numeric Errors) affecting the L2TP control-message parsing path on the D-Link DIR-605. When the router processes an incoming L2TP control message containing a Host Name Attribute-Value Pair (AVP), the tunnel_set_params function copies the attacker-supplied peer_hostname value into a fixed-size buffer. A boundary calculation error allows a single byte to be written past the end of the destination buffer.
Off-by-one writes on embedded MIPS-based devices frequently corrupt adjacent stack or heap metadata. The impact ranges from denial of service to arbitrary code execution depending on memory layout and the byte value written. Successful exploitation grants network-level access to router functionality without any user interaction.
Root Cause
The defect stems from incorrect length validation of the peer_hostname parameter before it is copied into a fixed-size destination buffer within the L2TP tunnel structure. The bounds check permits a length equal to the buffer size, but the copy operation writes an additional terminating byte, producing a one-byte overflow into adjacent memory.
Attack Vector
An unauthenticated remote attacker sends a crafted L2TP control message containing an oversized Host Name AVP to the target router. The malicious packet reaches the L2TP daemon, which invokes tunnel_set_params and triggers the out-of-bounds write. Exploitation complexity is high because success depends on precise memory layout and constrained payload characteristics inherent to a single-byte overflow.
See the technical writeup and the VulDB entry for detailed technical analysis.
Detection Methods for CVE-2026-86297
Indicators of Compromise
- Unexpected L2TP control traffic (UDP port 1701) directed at internal DIR-605 devices from external sources
- Router crashes, reboots, or L2TP daemon (pppd) instability without corresponding administrative activity
- L2TP SCCRQ (Start-Control-Connection-Request) packets containing abnormally long Host Name AVP values
Detection Strategies
- Inspect L2TP control messages at the network perimeter and alert on Host Name AVP lengths approaching or exceeding protocol-typical values
- Correlate L2TP session establishment attempts with device availability metrics to identify parser-triggered failures
- Monitor firmware version inventory to identify DIR-605 devices running the vulnerable B1v202WWB03 build
Monitoring Recommendations
- Enable logging on upstream firewalls for all inbound UDP/1701 traffic destined for consumer-grade routers
- Track syslog output from affected devices for pppd or l2tp process termination events
- Baseline normal L2TP client behavior to surface anomalous control-message patterns originating from untrusted sources
How to Mitigate CVE-2026-86297
Immediate Actions Required
- Block inbound UDP port 1701 (L2TP) at the network edge for any DIR-605 device not required to accept external tunnels
- Restrict management and VPN service exposure to trusted internal networks only
- Inventory deployed D-Link DIR-605 units and identify those running firmware B1v202WWB03
- Replace end-of-life DIR-605 hardware with actively supported models where feasible
Patch Information
No vendor patch has been referenced in the published advisory data at the time of writing. Consult the D-Link official website for firmware updates and security bulletins specific to the DIR-605 platform. Refer to the VulDB vulnerability record for ongoing status tracking.
Workarounds
- Disable the L2TP server functionality on the router if it is not required for operational use
- Place affected devices behind an upstream firewall that filters or rate-limits L2TP control traffic
- Segment the router from sensitive internal assets to limit blast radius if the device is compromised
- Plan hardware replacement, since the DIR-605 line is legacy consumer equipment with limited ongoing vendor support
# Example perimeter filter to block external L2TP control traffic
iptables -A FORWARD -p udp --dport 1701 -i <wan_iface> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
