CVE-2026-86295: D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-07 · updated 2026-09-08
Weakness: CWE-74

Description

A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Affected products

D-Link DIR-895L: A1_102b07

References

https://tzh00203.notion.site/D-Link-DIR-895L-Command-Injection-in-udhcpd-sendACK-TR-069-Host-Helper-33cb5c52018a80aaaa5be16a761ff457
https://vuldb.com/cve/CVE-2026-86295
https://vuldb.com/submit/906296
https://vuldb.com/vuln/399457
https://vuldb.com/vuln/399457/cti
https://www.dlink.com/

Get alerted when CVE-2026-86295 or the next vulnerability affects your stack