Cpe:2.3:h:dlink:dir-825:3.00b32:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3hdlinkdir-8253.00b32/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 24 Sep 2026 04:45:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Out-of-Bounds Write in D-Link DIR-825https://feed.craftedsignal.io/briefs/2026-09-dlink-dir825-oob-write/Thu, 24 Sep 2026 04:45:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-dlink-dir825-oob-write/A critical out-of-bounds write vulnerability in the D-Link DIR-825 firmware (version 3.00b32) allows remote attackers to trigger memory corruption via the peer_hostname parameter.CVE-2026-96891 is a critical security vulnerability discovered in the D-Link DIR-825 router, specifically affecting firmware version 3.00b32. The flaw resides within the tunnel_set_params function located in the rp-l2tp component, specifically within the source file tunnel.c. An attacker can trigger the vulnerability by sending a maliciously crafted input to the peer_hostname argument. Because the input handling fails to properly validate memory boundaries, this manipulation results in an out-of-bounds write condition. This flaw is remotely exploitable, posing a significant risk to affected devices by potentially allowing unauthenticated remote code execution or causing persistent denial-of-service conditions through device instability and memory corruption.

Impact

The vulnerability carries a CVSS v3.1 base score of 9.8, indicating a high potential for severe impact. Successful exploitation allows remote attackers to compromise the integrity and availability of the affected D-Link DIR-825 hardware. This may lead to total device takeover or system crashes, impacting network availability for organizations or home users relying on this router.

Recommendation

  1. Identify all D-Link DIR-825 devices running firmware version 3.00b32 within the organization's network inventory.
  2. Restrict management interface access for identified devices to trusted administrative subnets until a vendor patch is applied.
  3. Monitor ingress traffic to the device for unusual strings or payload patterns targeting L2TP configurations that might indicate exploitation attempts.
  4. Contact D-Link support or check the official product security portal for firmware updates resolving CVE-2026-96891.
]]>criticaladvisoryvulnerabilitycvenetwork-security