A newly disclosed vulnerability in D-Link’s DIR-822A router has earned the rare distinction of a perfect 10.0 on the CVSS 3.1 scale, the maximum possible severity score, after researchers found that it can be triggered by a remote, unauthenticated attacker with no user interaction whatsoever. Making matters worse, a working proof-of-concept exploit is already public, and D-Link has not yet shipped a fix.

An old bug pattern in a still-active product

The flaw, tracked as CVE-2026-86296, lives in the router’s udhcpcd component, specifically within serverpacket.c. The root cause is a textbook stack-based buffer overflow: the code uses an unsafe strcpy call to copy attacker-controlled data into a fixed-size stack buffer without checking its length first. Send oversized input, and the excess data spills into adjacent memory, which can crash the device, disrupt its network service, or in the worst case be leveraged for arbitrary code execution.

The vulnerability affects firmware version A_101 on the DIR-822A model. D-Link has acknowledged the report but says it has not yet confirmed which hardware revisions are affected, how the exposure varies by region, or when a firmware fix will be ready, leaving a gap between disclosure and remediation that attackers are well positioned to exploit.

A second flaw compounds the risk

Researchers also disclosed a related, though separate, issue: CVE-2026-86510, an out-of-bounds write in the router’s L2TP control message parser, rated 9.9 under CVSS 3.1 and 9.4 under the newer CVSS 4.0 standard. Exploiting it requires low privileges but, like the first bug, no user interaction, and a public proof-of-concept for this flaw has also surfaced. Between the two, an attacker has multiple paths to destabilize or potentially seize control of an exposed device.

Why unauthenticated, no-interaction bugs on routers matter so much

Consumer and small-business routers occupy a uniquely exposed position on the network: they are frequently left with remote administration enabled, rarely patched promptly by end users, and sit directly between a local network and the internet. A flaw that needs no credentials and no click from a victim is exactly the profile that historically fuels large-scale botnet recruitment and automated scanning campaigns, since attackers can write a single exploit and sweep the internet for vulnerable devices with little manual effort.

With public proof-of-concept code already available for both CVE-2026-86296 and CVE-2026-86510, the window between disclosure and mass exploitation attempts is likely to be short. Devices with their administration interface reachable from the open internet are at the highest immediate risk. The CVSS vector for the primary flaw, AV:N/AC:L/PR:N/UI:N, spells out exactly why it scored a perfect 10: it is reachable over the network, requires low attack complexity, needs no privileges, and needs no interaction from anyone using the device. Researchers classify the underlying weakness under CWE-121 (stack-based buffer overflow) and the broader CWE-119 memory bounds category, two of the oldest and best-understood bug classes in software security, which makes it all the more notable that a shipping consumer product remains exposed to them in 2026.

Routers in this class are also frequently resold, repurposed, or left running for years past their original support window, which means even after D-Link ships a fix, a meaningful share of DIR-822A devices in the field may never receive it. That gap between patch availability and real-world patch adoption is precisely what turns a single disclosed flaw into a durable, long-running source of compromised devices that attackers can draw on for botnets, traffic proxying, or as a foothold into whatever network the router sits on.

What device owners should do now

Until D-Link finalizes and ships firmware fixes, the company is advising a set of interim precautions, and security researchers echo the same guidance:

• Disable remote management on the router unless it is strictly necessary
• Restrict any administrative access to trusted, local systems only, never expose the admin panel directly to the internet
• Watch D-Link’s regional support portals for firmware updates addressing these CVEs
• Confirm the exact hardware revision of the device before applying any future patch, since fixes are likely to be revision-specific
• Consider placing the router behind an additional firewall or replacing it if it can no longer receive vendor updates

Given the maximum severity score and the availability of public exploit code, organizations and individuals running the DIR-822A should treat this as an immediate action item rather than something to defer until a patch arrives.