CVE-2026-100740: D-Link DIR-895L Flaw
TL;DR - CVE-2026-100740 is a critical remote out-of-bounds write in the DIR-895L L2TP Control Channel Parser. - D-Link DIR-895L A1 firmware
A1_102b07is affected; no confirmed fixed firmware version was identified. - NVD reports a public exploit, but CISA KEV does not currently confirm active exploitation.
Are You Affected?
The CVE-2026-100740 D-Link DIR-895L vulnerability affects the product identified in the available NVD record as D-Link DIR-895L hardware revision A1 running firmware A1_102b07. No broader affected-version range was provided. The available evidence does not establish whether other DIR-895L hardware revisions or later firmware releases are vulnerable. Administrators should not assume that a different revision or later build is safe without explicit confirmation from D-Link.
| Field | Assessment |
|---|---|
| CVE | CVE-2026-100740 |
| Product | D-Link DIR-895L |
| Affected version | Hardware revision A1, firmware A1_102b07 |
| CVSS base score | 9.9, Critical |
| CVSS vector | Not supplied in the available NVD record |
| Attack vector | Remote manipulation of L2TP control-channel input |
| Authentication required | Unknown because the complete CVSS vector is unavailable |
| Patch available | No confirmed fixed version identified |
| CISA KEV status | Not listed |
Treat the device as exposed if it accepts L2TP control-channel traffic from an untrusted network, particularly the public Internet. Even when L2TP is not intentionally used, review legacy router services and management configurations because the vulnerable parser processes protocol input.
Technical Notes
The reported vulnerable code is the tunnel_set_params function in tunnel.c, within the router’s L2TP Control Channel Parser. The primary technical reference describes the issue as an L2TP Host Name AVP out-of-bounds write, but the complete trigger and exploit chain could not be independently validated from the retrieved material.
Inventory firmware directly from the router administration interface or through the organization’s asset-management process. Do not classify a device as remediated solely because its firmware is newer than A1_102b07; no fixed version was identified in the available research.
Organizations managing multiple network appliances can use a documented vulnerability management process to track affected assets, exposure, compensating controls, and replacement decisions.
The Fix, If You’re in a Hurry
There is currently no confirmed D-Link firmware version to which administrators can upgrade for this CVE. Check D-Link’s security bulletin page for a new advisory or replacement firmware. Do not presume a later firmware version is safe unless D-Link explicitly identifies it as fixing CVE-2026-100740.
The safest immediate response is to remove the router from untrusted network exposure, block L2TP access at upstream firewalls, and replace the device if it is end-of-life or cannot receive a supported security update. If the router is used for remote access, migrate that function to a supported platform rather than leaving the vulnerable parser reachable.
A VPN service on an individual laptop or phone can help protect traffic on untrusted networks during a transition; it does not patch or protect an exposed DIR-895L. If that is relevant to your users’ temporary travel or remote-work arrangements, consider a reputable VPN provider such as Check NordVPN pricing →, while continuing to prioritize router replacement and network-level controls.
Technical Notes
There is no vendor-provided upgrade command available to reproduce safely. Do not attempt to flash unofficial firmware or use a guessed image. The operational workaround is to block L2TP control traffic at the nearest capable firewall. For a Linux nftables firewall with an existing inet filter input chain, an example rule is:
sudo nft add rule inet filter input udp dport 1701 drop
sudo nft list chain inet filter input
Apply the equivalent control at the perimeter firewall, VPN gateway, or upstream router. Confirm that the rule matches the organization’s actual L2TP deployment and does not disrupt a required service. If the DIR-895L itself is the Internet-facing endpoint, place a supported firewall or replacement router in front of it, then disable or retire the vulnerable device.
A web application firewall generally does not mitigate this issue because the vulnerable service is an L2TP parser rather than an HTTP application. Use a network firewall or equivalent access-control device that can filter the relevant L2TP traffic.
How This Vulnerability Works
CVE-2026-100740 is an out-of-bounds write in the DIR-895L’s L2TP control-channel parsing path. The affected function is tunnel_set_params in tunnel.c. An out-of-bounds write occurs when code writes data beyond the boundaries of an allocated buffer or other valid memory region. In a network appliance, that can corrupt adjacent state, terminate a service, or create conditions for code execution.
NVD states that the attack can be initiated remotely through manipulated L2TP control-channel input. The available material does not provide a complete proof-of-concept trigger, memory-layout analysis, or validated arbitrary-code-execution chain. Secondary coverage discusses possible router compromise, but those impact details should be treated as potential consequences rather than independently confirmed outcomes.
The reference title points to the L2TP Host Name Attribute-Value Pair, or AVP, as the likely malformed input area. That is useful investigative context, not a substitute for a vendor advisory or complete technical analysis. Defenders should focus on controlling reachability to the parser rather than attempting to reproduce the crash on production equipment.
Severity, Explained
NVD assigns CVE-2026-100740 a CVSS base score of 9.9, classified as Critical. The available NVD response does not include the CVSS vector string. The individual CVSS components, including the exact attack-complexity, privileges-required, user-interaction, scope, confidentiality, integrity, and availability values, therefore cannot be stated reliably.
The known facts still support urgent handling: the vulnerable component processes remotely supplied L2TP control-channel data, and the flaw is a memory-corruption issue. The missing vector means the exact authentication requirement is unknown. Organizations should not report “no authentication required” as an established fact unless D-Link, NVD, or a validated technical analysis confirms it.
A 9.9 score indicates severe potential impact, but it does not prove that every affected router can be remotely taken over. The practical risk depends on whether L2TP is reachable, how the firmware handles the malformed input, device exposure, and the availability of mitigations. Internet-facing devices should receive priority over isolated devices behind a properly filtered perimeter.
Analyst’s Take: Treat this as an exposure-control problem first, not as a vulnerability to reproduce on production routers. The 9.9 score and public exploit availability justify urgent action, but the missing CVSS vector and incomplete exploit details limit what can be claimed about authentication or compromise.
Is It Being Exploited?
NVD states that the exploit is public and may be used. A technical write-up hosted on Notion is listed among the references, but the retrieved page returned the Notion application shell rather than the underlying advisory content. No independently verified GitHub proof-of-concept repository was identified in the research used for this assessment.
CVE-2026-100740 is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-09-27. There is therefore no CISA confirmation that this specific vulnerability is being exploited in the wild or associated with a ransomware campaign. Public exploit availability and confirmed active exploitation are different indicators: the former warrants defensive action, but it should not be reported as confirmed in-the-wild exploitation.
Detecting It in Your Environment
Start with asset inventory. Search for D-Link DIR-895L devices, confirm hardware revision A1, and record firmware versions. Pay particular attention to routers with public addresses, port-forwarding rules, remote administration, or L2TP enabled. If a device cannot be identified or verified, treat it as potentially affected until it is isolated or replaced.
Network monitoring should look for unexpected inbound UDP traffic to the L2TP control port, commonly UDP 1701. This is a triage indicator, not a complete exploit signature. A matching packet does not prove exploitation, and an attacker could use a different path if the device exposes L2TP through a nonstandard configuration.
Technical Notes
A simple search against firewall logs can identify inbound L2TP traffic. Adjust field names and log locations for the local platform:
grep -E 'UDP.*:1701|DPT=1701|dport=1701' /var/log/firewall.log /var/log/messages 2>/dev/null
A Splunk-style query for perimeter telemetry might be:
index=network (dest_port=1701 OR dport=1701)
| stats count min(_time) as first_seen max(_time) as last_seen
values(src_ip) as source_ips values(dest_ip) as destination_ips
by action, transport
Review accepted connections first, then correlate source addresses and timestamps with router restarts, management-plane alerts, unexpected configuration changes, and loss of VPN availability. A crash or reboot following unsolicited L2TP input is suspicious but not conclusive. Preserve firewall, router, and network-flow logs before rebuilding or replacing the device.
If packet capture is authorized, filter for L2TP traffic:
sudo tcpdump -ni any 'udp port 1701'
Do not attempt to send malformed test traffic to production routers merely to validate exposure. Use passive monitoring and controlled lab testing with vendor-approved guidance instead.
Recommended Response Checklist
- Identify all D-Link DIR-895L devices and verify hardware revisions and firmware.
- Prioritize A1 devices running
A1_102b07, especially those reachable from the Internet. - Disable unnecessary L2TP services and remove public exposure.
- Block inbound UDP 1701 and related L2TP traffic at an upstream firewall where appropriate.
- Review router, firewall, and network-flow logs for unexpected L2TP activity.
- Check D-Link’s security bulletin page for a confirmed advisory or fixed firmware.
- Replace unsupported devices or those without a confirmed remediation.
- Preserve relevant logs before rebuilding, resetting, or retiring a potentially compromised router.
References and Further Reading
The primary record is the NVD entry for CVE-2026-100740. It identifies the DIR-895L A1 firmware A1_102b07, the tunnel_set_params function, the L2TP Control Channel Parser, the remote attack path, the 9.9 base score, and public exploit availability. The NVD record does not provide a complete CVSS vector or a confirmed fixed firmware version.
Further references include the technical write-up titled “D-Link DIR-895L L2TP Host Name AVP Out-of-Bounds Write,” the VulDB CVE record, and secondary coverage from TheHackerWire. The technical write-up should be treated as reference-derived context because its underlying content was not fully retrievable during review. D-Link’s official security bulletin should remain the authoritative source for any future vendor acknowledgement or firmware remediation.
- NVD-linked technical reference: D-Link DIR-895L L2TP Host Name AVP Out-of-Bounds Write
- VulDB: CVE-2026-100740
- D-Link Security Bulletin
- TheHackerWire coverage
- TheHackerWire CVE page
Because no confirmed patch is available in the reviewed material, organizations should restrict L2TP exposure now, inventory and isolate affected DIR-895L devices, and track D-Link’s advisory page for an explicit remediation. Replace unsupported devices where a supported fix cannot be established.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.