Description

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-08T02:17:28.357Z",
  "pubdate": "2026-09-08T02:17:28.357Z",
  "executiveSummary": "The D-Link DIR-822A A_101 is susceptible to a critical out-of-bounds write vulnerability located within the L2TP Control Message Parser.\nThis memory corruption flaw stems from improper handling of parameters within the tunnel_set_params function.\nA remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted L2TP control packets to the device.\nSuccessful exploitation allows for memory corruption, which can lead to arbitrary code execution, system instability, or a complete denial-of-service condition.\nGiven that the exploit is publicly disclosed, the risk is classified as high, as it grants attackers the capability to compromise the device remotely without requiring prior authentication.\nThe vulnerability significantly impacts the integrity and availability of the affected D-Link hardware, making immediate risk mitigation and network segmentation essential for defense.",
  "technicalDetails": "The vulnerability resides in the tunnel_set_params function within the L2TP (Layer 2 Tunneling Protocol) control message parsing logic of the D-Link DIR-822A A_101 firmware.\nThe root cause is a lack of rigorous bounds checking when processing L2TP control message parameters. When the firmware parses incoming L2TP packets, the tunnel_set_params function fails to validate the size of user-supplied data before copying it into a fixed-length memory buffer.\nThis flaw facilitates an out-of-bounds (OOB) write operation, where an attacker can overwrite adjacent memory segments beyond the allocated buffer boundaries.\nThe attack flow begins with the attacker crafting a malicious L2TP packet containing a payload designed to trigger the OOB write. This packet is sent to the target device's L2TP service, which is typically exposed on the WAN or LAN interfaces. Upon receipt, the L2TP Control Message Parser processes the malicious input and passes the unsanitized parameters to the tunnel_set_params function.\nBy carefully structuring the malicious payload, an attacker can overwrite critical data structures, such as function pointers, return addresses, or local variables in the stack or heap, depending on the specific memory layout of the binary.\nBecause the vulnerability occurs within the protocol parsing routine, no user interaction or authentication is required. If the system memory is successfully corrupted, the attacker can redirect the execution flow of the firmware to an arbitrary memory location, effectively enabling remote code execution (RCE) with the privileges of the underlying service.\nIn the event of an unsuccessful RCE attempt, the memory corruption will likely trigger a process crash, resulting in a denial-of-service (DoS) state that requires a hardware reboot to resolve.\nThe exposure of this vulnerability is significant, as it can be leveraged over standard network protocols without requiring internal network presence. Since public exploit code exists, the barrier to entry for potential attackers is extremely low, allowing for automated exploitation attempts against vulnerable endpoints."
}