External risk intelligence

D-Link DIR-825 Out-of-Bounds Write Vulnerability in L2TP Tunnel Parameter Handling.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-96891

The affected product is a D-Link wireless router, which typically functions as an internet-facing gateway device. Because the vulnerability involves L2TP tunnel parameter handling, it is reachable via protocols commonly processed by edge networking equipment that bridges internal and external traffic.

Memory Corruption

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been discovered in D-Link routers related to how they handle network connection parameters. This issue could allow remote attackers to cause a system to write data outside of its intended memory space, potentially disrupting operations. The primary concern at this time is to determine if this specific technology is in use and, if so, to what extent it is exposed.

Remote flaw affects network device parameters.
Critical flaw impacts internet-facing gateway devices.
Confirm relevance and exposure of affected technology.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable rp-l2tp component over the network by sending specially crafted L2TP control messages. This component handles the Layer 2 Tunneling Protocol, and a flaw in the tunnel_set_params function allows an out-of-bounds write when manipulating the peer_hostname argument. This could lead to memory corruption and potential remote code execution.

Attack is remote and unauthenticated.
Triggered by manipulating hostname argument in L2TP packets.
Risk of memory corruption and code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the L2TP tunnel configuration function could allow an unauthenticated, remote attacker to cause an out-of-bounds write. This could affect the normal operation of the device when processing L2TP connections.

Router stability.
Remote manipulation of tunnel parameters.
Device disruption or failure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The D-Link DIR-825 router's L2TP component is affected by an out-of-bounds write vulnerability. Owners of this device, likely home users or small businesses, should first identify all instances of the DIR-825 within their environment, confirm they are internet-facing, and then plan remediation or mitigation.

Home/small business users to manage.
Verify if the device is internet-facing.
Plan for replacement or security hardening.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the D-Link DIR-825, and what is the rp-l2tp component?

The D-Link DIR-825 is a wireless router used to provide home or small office internet connectivity. It functions as a gateway, managing traffic between a local network and the internet. The rp-l2tp component is a software module within the router's firmware responsible for managing the Layer 2 Tunneling Protocol, which is used to create secure or private connections over public network infrastructures.

What does out-of-bounds write mean for CVE-2026-96891?

This vulnerability is classified as an out-of-bounds write (CWE-119, CWE-787). In simple terms, it means the router's software tries to save data into a memory location that it does not have permission to access. By writing data outside of its intended boundaries, the program can overwrite other critical information, which can lead to system instability or allow an attacker to hijack the device's normal operation.

How is this memory corruption triggered?

An attacker triggers this flaw by sending a specially crafted L2TP control message to the router. Specifically, the vulnerability resides in the tunnel_set_params function, which incorrectly processes the peer_hostname argument provided within these messages. If the input is not handled correctly, it causes the software to perform the dangerous memory write. The bug is not triggered by standard, legitimate network traffic that follows expected protocol formats.

Why does Halo Surface Signal categorize this as an external risk?

Halo Surface Signal identifies this as an external risk because the D-Link DIR-825 typically acts as an internet-facing gateway device. Because the vulnerable component handles L2TP tunnel parameters—a protocol often processed at the network edge—the device is directly reachable by remote, unauthenticated attackers over the internet, making it highly susceptible to exploitation.

Is there a first step for owners of this router?

The first step is to locate and verify if you have the D-Link DIR-825 model running version 3.00b32 in your environment. Once identified, confirm whether the device is exposed directly to the internet. If it is, consider the risk to your network operations and prepare to implement security hardening or plan for a replacement, as this component handles critical connection functions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.