Description

A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname  leads to out-of-bounds write. The attack may be initiated remotely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-24T03:16:58.950Z",
  "pubdate": "2026-09-24T03:16:58.950Z",
  "executiveSummary": "A critical out-of-bounds write vulnerability has been identified in the rp-l2tp component of the D-Link DIR-825 firmware, specifically within the tunnel_set_params function located in tunnel.c.\nThe vulnerability arises due to improper handling of the peer_hostname argument, which can be manipulated to cause memory corruption.\nThis flaw allows for remote exploitation, potentially enabling an unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition on the affected device.\nGiven that the vulnerability exists within the tunneling protocol implementation, it exposes the device to remote exploitation, posing a significant risk to the integrity and availability of the router.\nThe primary risk implication is the potential for full system compromise, as out-of-bounds write vulnerabilities often lead to memory corruption, enabling execution flow redirection in a privileged context.",
  "technicalDetails": "The vulnerability is situated within the rp-l2tp component, which manages Layer 2 Tunneling Protocol (L2TP) sessions. The flaw originates in the tunnel_set_params function defined in tunnel.c.\nThe root cause is an insufficient bounds check when processing the peer_hostname argument provided via an L2TP configuration request or signaling packet. During the execution of tunnel_set_params, the system copies the peer_hostname string into a fixed-size buffer without adequately validating the length of the input string.\nAn attacker can exploit this by crafting a malicious L2TP packet containing an oversized peer_hostname string. When the rp-l2tp process attempts to copy this string into the destination buffer, it exceeds the pre-allocated memory boundaries, resulting in an out-of-bounds write (buffer overflow).\nThe attack flow proceeds as follows: First, the attacker initiates a connection or transmits a specifically crafted L2TP control message to the target device. This message includes the manipulated peer_hostname parameter. The vulnerable tunnel_set_params function subsequently processes this parameter, triggering the heap or stack-based overflow during the copy operation.\nBecause this process occurs within the context of the rp-l2tp component, the memory corruption can be leveraged to overwrite adjacent metadata, function pointers, or return addresses in the process memory space. Successful exploitation allows an attacker to hijack the instruction pointer, leading to arbitrary code execution with the privileges of the rp-l2tp process.\nThe exposure is network-based, meaning the vulnerability is reachable over the network interface if L2TP services are exposed. No prior authentication is explicitly required if the vulnerability can be triggered during the initial handshake or negotiation phase of the L2TP connection.\nThe impact of a successful exploitation is severe, as it grants an attacker the ability to gain unauthorized control over the device, bypass security restrictions, or permanently disrupt device functionality, necessitating an immediate focus on mitigation strategies to limit exposure."
}