Description

A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-27T01:17:17.810Z",
  "pubdate": "2026-09-27T01:17:17.810Z",
  "executiveSummary": "A critical out-of-bounds write vulnerability exists within the L2TP Control Channel Parser of the D-Link DIR-895L router, specifically within the firmware version A1_102b07.\nThis vulnerability is categorized as a memory corruption flaw, which allows a remote, unauthenticated attacker to inject malicious data that triggers an out-of-bounds write operation.\nThe successful exploitation of this vulnerability can result in the corruption of critical memory segments, leading to potential arbitrary code execution (ACE), system instability, or a complete denial-of-service (DoS) condition.\nGiven that the exploit for this vulnerability is publicly available, the risk of exploitation by threat actors is high. The flaw resides in the handling of control channel parameters, specifically within the tunnel_set_params function, making the device susceptible to remote compromise without prior authentication.\nOrganizations and individual users utilizing the affected hardware must treat this as a high-priority security concern due to the ease of remote reachability and the severity of the potential impact on device integrity.",
  "technicalDetails": "The vulnerability originates in the tunnel_set_params function located within the tunnel.c file, which is responsible for processing parameters sent through the L2TP (Layer 2 Tunneling Protocol) control channel.\nThe root cause of the vulnerability is insufficient bounds checking during the parsing of incoming L2TP control packets. When the L2TP Control Channel Parser processes specific attribute-value pairs (AVPs), it fails to validate the size of the input data against the allocated destination buffer size.\nThe attack flow initiates with the transmission of a crafted L2TP control message to the target device. Because this component handles L2TP traffic, an attacker can send this packet remotely over the network. Upon receipt, the firmware's control channel parser directs the payload to the tunnel_set_params function.\nWithin tunnel_set_params, the function performs a write operation using attacker-supplied length or offset values without adequate validation. This allows the attacker to write data past the intended memory boundary. This memory corruption can be leveraged to overwrite adjacent function pointers, return addresses, or other critical structures within the process heap or stack.\nBy carefully crafting the malicious payload, an attacker can manipulate the execution flow of the firmware. If the attacker overwrites sensitive control data, they can redirect the CPU's instruction pointer to execute shellcode injected into the device's memory. This typically leads to full remote code execution, granting the attacker control over the underlying Linux-based operating system of the DIR-895L router.\nFurthermore, even if code execution is not the primary objective, the out-of-bounds write can easily trigger memory access violations, resulting in an immediate system crash or kernel panic, thereby inducing a persistent denial-of-service state until the device is manually rebooted.\nSince this vulnerability is triggered during the early stages of L2TP session negotiation, the attack does not require valid user credentials, effectively bypassing standard authentication mechanisms for the management interface. The remote accessibility of the L2TP service exposes this flaw to any attacker capable of reaching the device's management or WAN/LAN interface, depending on the specific network configuration.\nPost-exploitation impact includes persistent access to network traffic, the ability to modify device settings, pivoting into the local network, or transforming the router into a node for a botnet, given the high level of privilege associated with the firmware execution environment."
}