Description
A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname  leads to out-of-bounds write. The attack may be initiated remotely.
Published: 2026-09-24
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An out‑of‑bounds write occurs in the rp‑l2tp component's tunnel_set_params function when the peer_hostname argument is processed, allowing an attacker to corrupt memory on the D‑Link DIR‑825 router. The flaw, rated with a CVSS score of 9.3, indicates a high possibility of remote exploitation that could lead to code execution or service interruption.

Affected Systems

The vulnerability affects D‑Link DIR‑825 routers running firmware version 3.00b32. No other firmware revisions or product variants are listed in the CNA data.

Risk and Exploitability

The flaw is remotely exploitable via the L2TP protocol, requiring only network access to the router. Because the EPSS score is unavailable, the exact likelihood of active exploitation is unknown, and the flaw has not yet appeared in CISA’s KEV catalog. Nevertheless, the high CVSS rating and the ability to overwrite memory make it a serious risk that could allow attackers to take control of the device or cause a denial of service.

Generated by OpenCVE AI on September 24, 2026 at 04:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the DIR‑825 firmware to the latest version released by D‑Link that corrects the out‑of‑bounds write in rp‑l2tp.
  • If a firmware update cannot be applied, block or filter L2TP traffic destined for the router to prevent the exploitation vector.
  • Maintain ongoing monitoring of network traffic and router logs for abnormal L2TP activity, and consider disabling unused remote management features to reduce exposure.

Generated by OpenCVE AI on September 24, 2026 at 04:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 03:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname  leads to out-of-bounds write. The attack may be initiated remotely.
Title D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write
First Time appeared D-link
D-link dir-825
Weaknesses CWE-119
CWE-787
CPEs cpe:2.3:h:d-link:dir-825:*:*:*:*:*:*:*:*
Vendors & Products D-link
D-link dir-825
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X'}

Subscriptions

D-link Dir-825
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-24T15:47:57.530Z

Reserved: 2026-09-23T19:12:25.042Z

Link: CVE-2026-96891

cve-icon Vulnrichment

Updated: 2026-09-24T15:46:11.576Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T03:16:58.950

Modified: 2026-09-24T16:17:28.193

Link: CVE-2026-96891

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T05:00:13Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write