D-Link DIR-822A routers have a vulnerability rated as "critical" with publicly available exploit code, and the manufacturer has not yet released a fix: an attacker can take control of the router without a password.
This is CVE-2026-86296, a stack-based buffer overflow in the router's network address management (DHCP) component. A specially crafted packet sent to the device can execute commands on the router without authentication and without user interaction. The vulnerability has been assigned the maximum severity score, and an exploit code is already publicly available. The vendor’s advisory (SAP10516) also mentions a second critical vulnerability in the same model: an out-of-bounds write in the L2TP component (CVE-2026-86510).
The DIR-822A router is an inexpensive device commonly found in small businesses, typically installed by an IT or internet service provider. Precisely because it’s a device that “just works,” its firmware often goes untouched for years.
Unlike many other vulnerabilities, there is no patch available yet: D-Link has announced that it is analyzing the affected hardware versions and the product's life cycle stage, but has not released an update to fix the issue. Until then, the only real protection is to minimize the device’s exposure.
The router sits at the edge of the company's network: whoever gains control of it can see and direct all incoming and outgoing traffic. That's why a vulnerable router that hasn't been patched isn't a problem you can put off indefinitely.
What you need to do:
- Ask your IT provider if you are using a D-Link DIR-822A router.
- Disable remote administration and do not allow access to the administration panel from outside the company.
- Keep the guest network separate from the company network.
- Since there is no fix, plan to replace the equipment with a model that continues to receive security updates.
Network equipment is quiet and often overlooked, but it lies at the very heart of the network. A simple message to your IT provider can clarify in just a few minutes whether you’re at risk.
This article was generated with AI assistance.