CVE-2026-96891: D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write
A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnelsetparams of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peerhostname leads to out-of-bounds write. The attack may be initiated remotely.
Affected Software
Event History
Frequently Asked Questions
Which devices are known to be affected?
The affected product identified is the D-Link DIR-825 running version 3.00b32. The vulnerable component is rp-l2tp, specifically the tunnel_set_params function in tunnel.c.
Does exploitation require authentication or user interaction?
No authentication or user interaction is indicated. The supplied vector rates the issue as network-reachable with low attack complexity and no required privileges or user interaction.
What access does an attacker need to exploit this issue?
The attack may be initiated remotely. Exploitation involves manipulating the peer_hostname argument supplied to the vulnerable tunnel_set_params function.
Is there a documented workaround or fixed version?
The provided information does not identify a fixed version, patch, configuration workaround, or mitigation.