Description

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-08T01:17:55.947Z",
  "pubdate": "2026-09-08T01:17:55.947Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the udhcpcd component of the D-Link DIR-895L A1_102b07 firmware.\nThe vulnerability is localized within the sendOffer and sendACK functions of the serverpacket.c file.\nExploitation allows a remote attacker on the local network to trigger a stack-based buffer overflow, which may lead to arbitrary code execution, denial of service, or complete system compromise.\nThe flaw stems from insufficient boundary checking during the processing of DHCP packets.\nGiven that exploit code is publicly available, the risk to affected devices is high, necessitating immediate defensive measures to prevent unauthorized access or system instability.\nThe attack is restricted to the local network segment, requiring the attacker to have network access to the target device's DHCP service.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow located in the udhcpcd component of the D-Link DIR-895L firmware (version A1_102b07).\nThe flaw resides specifically within the sendOffer and sendACK functions defined in the file udhcpcd/serverpacket.c.\nThe root cause is an improper handling of input data when constructing DHCP response packets. The functions fail to perform adequate bounds checking on the data being copied into the stack-allocated buffers during the packet creation process.\nWhen the udhcpcd process prepares a DHCP offer or acknowledgment packet, it reads data from internal structures or received parameters to populate packet fields. If the input data is malformed or maliciously crafted, the copy operation exceeds the allocated buffer size on the stack.\nThis overflow allows an attacker to overwrite adjacent memory, including critical data such as the return address of the function on the stack.\nBy carefully controlling the input data provided to the DHCP server, an attacker can redirect the execution flow of the processor to arbitrary locations, effectively gaining control over the device's execution environment.\nThe attack flow requires the adversary to be present on the local network. The attacker sends a crafted request (such as a DHCP Discover or Request packet) to the device, which triggers the vulnerable code path in sendOffer or sendACK. As the server processes these requests and attempts to construct the corresponding response, the overflow occurs, leading to memory corruption.\nBecause the udhcpcd process typically runs with elevated privileges on embedded devices, successful exploitation results in the execution of arbitrary commands with the same privileges as the DHCP server process, typically root or administrative equivalent.\nPost-exploitation impact includes the potential for total device takeover, persistence through firmware manipulation, or the disruption of network services by crashing the DHCP server process, resulting in a denial-of-service condition for all devices relying on it for IP address assignment."
}