D-Link Is Still Investigating Two Critical Router Flaws With Public Exploit Code
Demonstration code is public for two critical DIR-822A flaws. Its advisory still lists no corrected firmware; both reports remain under investigation.
A crafted network request can overrun a buffer on the stack without a login (CVE-2026-86296, 10.0). The second flaw writes outside allocated memory with limited account access (CVE-2026-86510, 9.9). Neither requires a user to act; ratings use CVSS v3.1.
Reported firmware is A_101. Revision, region and lifecycle status remain unconfirmed; a similar-looking router may differ.
Reduce exposure now
- Record full model, hardware revision and installed build, rather than the product family.
- Disable unnecessary remote administration; block internet and other untrusted access to management services.
- Keep local management to named administration devices or a dedicated segment.
- Remove unused users and rotate shared credentials. The second flaw needs only limited account access.
- Monitor regional support; install only official firmware intended for that precise model and revision.
- Assess isolation or replacement where the router protects sensitive or business-critical systems. Waiting with the interface exposed may carry greater risk.
Public code can make study and reproduction easier. It does not establish active exploitation. Explain that difference when setting response deadlines; a reported flaw and a confirmed intrusion are different findings.
