CVE-2026-96891: D-Link DIR-825 RCE Vulnerability

CVE-2026-96891 Overview

CVE-2026-96891 is an out-of-bounds write vulnerability affecting D-Link DIR-825 routers running firmware version 3.00b32. The flaw resides in the tunnel_set_params function within tunnel.c, part of the rp-l2tp component that implements Layer 2 Tunneling Protocol (L2TP) handling. An attacker can trigger the condition by manipulating the peer_hostname argument during L2TP message processing. The attack can be initiated remotely across the network without authentication or user interaction. The weakness is classified under improper restriction of operations within memory buffer bounds [CWE-119].

Critical Impact
Remote unauthenticated attackers can corrupt memory on affected D-Link DIR-825 devices by sending a crafted L2TP Host Name AVP, potentially leading to arbitrary code execution on edge network equipment.

Affected Products

D-Link DIR-825 firmware version 3.00b32
rp-l2tp component (tunnel.c)
tunnel_set_params function processing the peer_hostname argument

Discovery Timeline

2026-09-24 - CVE-2026-96891 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96891

Vulnerability Analysis

The vulnerability resides in the tunnel_set_params routine of the rp-l2tp daemon shipped with D-Link DIR-825 firmware 3.00b32. During L2TP control message parsing, the routine processes the Host Name Attribute Value Pair (AVP) and copies the attacker-controlled peer_hostname value into a fixed-size destination buffer. The function does not validate that the source length fits within the destination, which allows memory beyond the buffer to be overwritten.

Because L2TP control messages are reachable over the network and no authentication is required to deliver them to the vulnerable code path, exploitation can be driven entirely from a remote source. Successful memory corruption on an embedded router can compromise confidentiality, integrity, and availability of the device, pivoting the attacker into a trusted position on the local network.

Root Cause

The root cause is missing bounds enforcement when writing the peer_hostname AVP into a stack or heap buffer inside tunnel_set_params. The code trusts the attribute length supplied by the peer rather than clamping the copy length to the destination capacity, producing a classic out-of-bounds write condition [CWE-119].

Attack Vector

An attacker transmits a malformed L2TP control packet containing an oversized Host Name AVP to the router. The rp-l2tp daemon parses the AVP and invokes tunnel_set_params, which writes the attacker-controlled bytes past the end of the target buffer. The attack requires no privileges, no user interaction, and no prior access to the device.

Technical write-up details are available in the Notion Security Analysis and the VulDB entry for CVE-2026-96891. No verified proof-of-concept code is published at the time of writing.

Detection Methods for CVE-2026-96891

Indicators of Compromise

Unexpected crashes, reboots, or watchdog resets of the rp-l2tp process on DIR-825 routers running firmware 3.00b32.
Inbound L2TP (UDP port 1701) traffic from untrusted sources containing oversized or malformed Host Name AVPs.
New or unexplained outbound connections originating from the router management plane after receiving L2TP traffic.

Detection Strategies

Inspect L2TP control packets at the network edge and alert on Host Name AVPs that exceed expected length thresholds.
Monitor router syslog streams for rp-l2tp segmentation faults, abnormal exits, or repeated restarts.
Correlate inbound L2TP traffic with subsequent configuration changes or administrative sessions on affected devices.

Monitoring Recommendations

Forward DIR-825 syslog and SNMP traps to a centralized logging platform to track daemon stability.
Baseline legitimate L2TP peers and alert on new source addresses initiating tunnels against the router.
Enable netflow or packet capture on WAN interfaces to retain evidence of exploitation attempts targeting UDP 1701.

How to Mitigate CVE-2026-96891

Immediate Actions Required

Block inbound L2TP traffic (UDP port 1701) from untrusted networks at the perimeter firewall.
Disable the L2TP service on the DIR-825 if VPN termination is not required for business operations.
Restrict router management interfaces to trusted administrative networks only.
Treat DIR-825 units running firmware 3.00b32 as end-of-support candidates and plan replacement if no vendor patch is available.

Patch Information

No vendor patch URL is listed in the NVD entry at the time of publication. Administrators should consult the D-Link Official Website for firmware updates and security bulletins specific to the DIR-825 platform, and review the VulDB vulnerability record for updates to remediation status.

Workarounds

Terminate L2TP tunnels on a dedicated, patched VPN concentrator instead of the DIR-825.
Place vulnerable devices behind an upstream firewall that filters malformed L2TP control messages.
Segment the DIR-825 away from sensitive internal assets to limit blast radius if the device is compromised.

bash

# Example: block inbound L2TP at an upstream Linux gateway
iptables -A FORWARD -p udp --dport 1701 -i eth0 -j DROP
iptables -A INPUT   -p udp --dport 1701 -i eth0 -j DROP