CVE-2026-96891

CriticalCVSS 9.8

Published: 24/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.65%

49th percentile - higher than 49% of all known CVEs

Summary

A vulnerability was identified in D-Link DIR-825 3.00b32 in the tunnel_set_params function of tunnel.c in the rp-l2tp component. Manipulation of the peer_hostname argument leads to an out-of-bounds write. The attack may be initiated remotely.

Risk Assessment

A remote attacker could exploit the out-of-bounds write to achieve arbitrary code execution or cause a denial of service on the network edge device.

Recommendation

Update the D-Link DIR-825 firmware to the latest version or restrict access to the management interface and network services to trusted networks.

Other vulnerabilities in D-Link DIR-825

CVE-2020-29557CriticalActively exploited
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.

Original NVD description (English source)

A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname leads to out-of-bounds write. The attack may be initiated remotely.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS