CVE-2026-86297CWE-193

CVE-2026-86297

High · published September 7, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
66.0
In the wild
Unconfirmed
What it is

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname  leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.01124 · 66.0th percentile
Weakness
CWE-193 · Off-by-one Error
Published
2026-09-07T15:17Z
References (6)
https://tzh00203.notion.site/D-Link-DIR-605-L2TP-Host-Name-AVP-Out-of-Bounds-Write-33cb5c52018a809ba163f988c15fc1b7 · [email protected]https://vuldb.com/cve/CVE-2026-86297 · [email protected]https://vuldb.com/submit/906299 · [email protected]https://vuldb.com/vuln/399459 · [email protected]https://vuldb.com/vuln/399459/cti · [email protected]https://www.dlink.com/ · [email protected]
EPSS history
Timeline
  • 09 SEP 03:20Z
    EPSS moved — → 1%
    epss
  • 07 SEP 10:45Z
    D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one
    cvelistv5