Cpe:2.3:o:dlink:dir-895l_firmware:a1_102b07:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3odlinkdir-895l_firmwarea1_102b07/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 07 Sep 2026 12:52:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Command Injection in D-Link DIR-895Lhttps://feed.craftedsignal.io/briefs/2026-09-dlink-command-injection/Mon, 07 Sep 2026 12:52:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-dlink-command-injection/An unauthenticated remote command injection vulnerability in the D-Link DIR-895L router allows attackers to execute arbitrary code via a malicious Hostname argument in the udhcpcd component.A remote command injection vulnerability (CVE-2026-86295) has been identified in D-Link DIR-895L routers running firmware version A1_102b07. The flaw resides within the sendACK function in the udhcpcd/serverpacket.c file of the udhcpcd component. An unauthenticated attacker can trigger this vulnerability by sending a specially crafted DHCP request containing a malicious payload within the Hostname argument. This allows for arbitrary command execution on the target device with the privileges of the affected process. Given that the exploit code has been made publicly available, there is a significant risk of exploitation by threat actors targeting residential and small office/home office (SOHO) network infrastructure.

Impact

Successful exploitation results in full remote control over the affected D-Link DIR-895L router. Attackers could leverage this access to intercept network traffic, redirect DNS queries, pivot into the local network, or incorporate the device into a botnet. This represents a critical risk to data confidentiality and integrity for any users on the local network managed by the vulnerable router.

Recommendation

  1. Inventory all D-Link DIR-895L devices within the network environment.
  2. Restrict access to administrative interfaces and DHCP-related management ports to trusted IP ranges where possible.
  3. Monitor for firmware updates from the vendor and apply patches immediately upon availability.
  4. Isolate affected hardware from critical segments until a vendor-supplied update is verified and installed.
]]>highadvisory