CVE-2026-100740
Received Received - Intake

Out-of-Bounds Write in D-Link DIR-895L A1 Firmware

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulDB

Description
A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100740
EUVD
EUVD-2026-87816

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
d-link dir-895l a1_102b07

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write flaw in the D-Link DIR-895L router's L2TP Control Channel Parser function called tunnel_set_params. It allows remote attackers to execute arbitrary code by manipulating input to the tunnel.c file. The exploit is publicly available, increasing the risk of attacks.

Detection Guidance

This vulnerability involves an out-of-bounds write in the L2TP Control Channel Parser of D-Link DIR-895L A1_102b07. Detection requires checking for affected firmware versions and monitoring for unusual network traffic patterns. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain control of your D-Link DIR-895L router, potentially intercepting network traffic, stealing data, or launching further attacks on your network. It may also enable unauthorized access to connected devices.

Compliance Impact

This vulnerability involves an out-of-bounds write in the L2TP Control Channel Parser of D-Link DIR-895L, which could allow remote attackers to execute arbitrary code or cause denial of service. Such vulnerabilities may lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately update the D-Link DIR-895L firmware to the latest available version to patch the vulnerability in tunnel.c. If no patch is available, consider isolating the device from the network or replacing it with a supported model. Monitor network traffic for unusual activity related to L2TP control channels.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart