Description

A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-07T11:17:39.373Z",
  "pubdate": "2026-09-07T11:17:39.373Z",
  "executiveSummary": "A critical command injection vulnerability exists within the udhcpcd component of the D-Link DIR-895L firmware (version A1_102b07).\nThe flaw originates from improper validation of the Hostname argument processed by the sendACK function within udhcpcd/serverpacket.c.\nThis vulnerability allows remote, unauthenticated attackers to execute arbitrary system commands with elevated privileges by injecting malicious payloads into the hostname field during DHCP transactions.\nThe risk is severe, as successful exploitation results in full device compromise, potentially leading to unauthorized network access, data exfiltration, or complete loss of control over the affected hardware.\nSince the exploit code is publicly available, the risk of exploitation by malicious actors is high.\nNo user interaction is required for successful exploitation, and the attack can be executed remotely over the network, bypassing standard authentication mechanisms.",
  "technicalDetails": "The vulnerability is classified as a command injection flaw occurring in the udhcpcd/serverpacket.c file of the udhcpcd component.\nSpecifically, the sendACK function fails to adequately sanitize the 'Hostname' field before it is utilized in system-level operations or passed to a command execution context.\nDuring the DHCP exchange process, the server constructs an acknowledgment packet. When the 'Hostname' option is present, the function concatenates this user-supplied data into a buffer or command string without performing sufficient input validation or escaping shell metacharacters.\nAttack flow: An attacker initiates a DHCP interaction with the target D-Link DIR-895L device. The attacker crafts a malicious DHCP request containing a crafted Hostname field. This field is embedded with shell command sequences (e.g., using backticks, semicolons, or pipe operators).\nWhen the udhcpcd service processes this request via the sendACK function, the underlying operating system interprets the unsanitized input as part of a shell command execution chain. The payload is subsequently executed by the system shell with the privileges of the udhcpcd process.\nBecause udhcpcd often runs with elevated (root) privileges to manage network interfaces and routing tables, the injected commands are executed with administrative rights, granting the attacker total control over the firmware environment.\nThe exposure is remote, as the DHCP service listens for broadcast or unicast traffic on the local area network. Since DHCP is a fundamental network discovery protocol, the service is inherently exposed to any device within the reachable network segment.\nPost-exploitation, an attacker can establish persistent backdoors, deploy malicious binaries, modify device configurations, or pivot into other segments of the internal network, effectively neutralizing the security posture of the host device.\nThe lack of input filtering or the use of insecure function calls to invoke shell commands constitutes the primary root cause of this memory and command integrity failure."
}