CVE-2026-86295

HIGHCVSS 8.3

Description

A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Timeline

Published:September 7th, 2026 11:17 AM

Last modified:September 8th, 2026 4:18 PM

CVSS Scoring

CVSS v3: 8.3 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

CVSS v2: 7.5

Weaknesses (CWE)

CWE-74 CWE-77

References & Reports

Advisories, patches, and third-party reports

https://tzh00203.notion.site/D-Link-DIR-895L-Command-Injection-in-udhcpd-sendACK-TR-069-Host-Helper-33cb5c52018a80aaaa5be16a761ff457
https://vuldb.com/cve/CVE-2026-86295
https://vuldb.com/submit/906296
https://vuldb.com/vuln/399457
https://vuldb.com/vuln/399457/cti
https://www.dlink.com/

Source: NIST NVD · Data may lag official sources by up to one minute