Description

A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-07T11:17:39.550Z",
  "pubdate": "2026-09-07T11:17:39.550Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists in the udhcpcd component of the D-Link DIR-822A A_101 firmware.\nThe vulnerability originates from the unsafe use of the strcpy function within the serverpacket.c file, leading to potential memory corruption.\nSuccessful exploitation allows a remote, unauthenticated attacker to inject arbitrary data into the stack, which can lead to remote code execution (RCE) or a denial-of-service (DoS) state by crashing the udhcpcd service.\nGiven that the exploit is publicly disclosed, the risk profile is elevated, necessitating immediate attention to limit exposure on affected network segments.\nThe vulnerability resides in the handling of DHCP server packets, meaning the service is inherently exposed to any network entity capable of transmitting crafted DHCP traffic to the device.\nAttackers do not require prior authentication or elevated privileges, significantly lowering the barrier for entry and increasing the likelihood of exploitation by automated bots or sophisticated threat actors.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow located in the udhcpcd/serverpacket.c file of the D-Link DIR-822A A_101 firmware. The root cause is identified as the usage of the strcpy function to process input data without performing adequate bounds checking on the destination buffer.\nIn C-based networking components, strcpy fails to verify the length of the source string before copying it into the target memory destination. When the udhcpcd service receives a crafted DHCP packet from the network, it reads the packet data and attempts to copy it into a fixed-size stack buffer. If the incoming payload exceeds the allocated capacity of this buffer, the data spills over into adjacent stack memory.\nThe attack flow begins when an attacker sends a malicious, oversized packet to the device's network interface. Because the DHCP service is typically listening on a socket to handle configuration requests, the overflow occurs during the parsing of this packet. By carefully crafting the payload, an attacker can overwrite critical control flow data, such as the saved return address on the stack.\nOnce the function execution concludes, the processor attempts to resume execution at the address stored in the overwritten return pointer. If the attacker has successfully controlled this value, they can redirect execution flow to arbitrary machine code injected within the malicious payload (shellcode) or initiate a Return-Oriented Programming (ROP) chain to bypass non-executable stack protections (NX/DEP).\nBecause this process occurs at the service level, the attacker gains the execution privileges associated with the udhcpcd process. If the service is running with root or administrative privileges—common in embedded router environments—the attacker achieves full control over the underlying operating system.\nThe vulnerability is remotely exploitable without authentication, as the DHCP service must process incoming packets from external or local sources to perform its required functions. The lack of input sanitization or length-validation checks in serverpacket.c directly exposes the memory management of the application to remote attackers. Post-exploitation impact ranges from permanent denial-of-service, resulting in a device crash, to total compromise of the router, enabling the attacker to monitor traffic, modify configuration, or use the device as a pivot point in a broader network attack."
}