CVE-2026-86297: D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one
A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnelsetparams of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peerhostname leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
Which devices are known to be affected?
The identified affected product is D-Link DIR-605 running B1v202WWB03. The available information does not establish whether other hardware revisions or firmware versions are affected.
Can this be exploited remotely without credentials?
Yes. The attack may be performed remotely, and the vector indicates no privileges or user interaction are required. Exploitation is nevertheless assessed as highly complex and difficult.
What component should be prioritized for exposure review?
Prioritize DIR-605 devices with L2TP functionality reachable from untrusted networks. The vulnerable code is in the L2TP Control Message Parser, specifically the handling of the peer_hostname argument in tunnel_set_params.
Is exploit code available?
Yes. The exploit is publicly available and may be used, which increases the urgency of reviewing exposed affected devices despite the stated exploitation difficulty.