CVE-2026-100740 — D-Link DIR-895L L2TP Host Name AVP Out-of-Bounds Write

September 27, 2026 · 126 views

Out-of-bounds write (CWE-787 / CWE-119) in D-Link DIR-895L firmware A1_102b07 L2TP tunnel_set_params() — Host Name AVP length clamped to 127 but NUL written at peer_hostname[len+1] on a 128-byte buffer. Remote attack over UDP 1701 when L2TP is active. PoC fingerprints the router, probes UDP 1701, optional lab-only --oob-send trigger. No vendor fix listed in NVD at publication.

#iot#d-link#router#l2tp#firmware#oob#embedded#network

CVE:

CVE-2026-100740

Date:

2026-09-27

Severity:

HIGH

Exploit source

PoC code is available to registered members only.

Description

Overview

CVE-2026-100740 affects D-Link DIR-895L firmware A1_102b07 only (per VulDB). In tunnel_set_params() (tunnel.c), the L2TP control channel parser mishandles the Host Name AVP: length is clamped to 127, but the NUL terminator is stored at peer_hostname[len+1] on a 128-byte stack buffer → out-of-bounds write and adjacent memory corruption (CWE-787 / CWE-119).

Attack surface: Remote, UDP 1701, when the router participates in L2TP (common as WAN client to an ISP L2TP server; malicious or spoofed upstream peer). Public exploit references exist; no vendor fix was listed in NVD at publication.

| | | |---|---| | Vendor / model | D-Link DIR-895L | | Firmware | A1_102b07 | | Component | L2TP control parser / tunnel.c | | Vector | Crafted Host Name AVP (len 127) | | Port | UDP 1701 | | CVSS 4.0 | VulDB PR:L, network, high impact |

Research (same bug class as DIR-822A): Notion — DIR-895L L2TP Host Name AVP

Open source PoC: https://github.com/murrez/CVE-2026-100740

PoC page: https://pocbit.org/pocs/cve-2026-100740

This repository fingerprints the router (HTTP), checks UDP 1701, and optionally sends a lab-only SCCRQ trigger (--oob-send). It does not ship a full RCE chain.

Bundled tool (Python 3)

pip install -r requirements.txt

python poc.py -u 192.168.0.1 --mode check
python poc.py -u 192.168.0.1 --mode check --l2tp-probe
python poc.py -u 192.168.0.1 --mode exploit --oob-send
python poc.py --list targets.example.txt --mode check -j 20

Impact

WAN-facing DIR-895L A1_102b07 units with L2TP enabled may be reachable by a network-positioned attacker. Memory corruption can lead to denial of service (device reboot/crash) or further exploitation in lab conditions. --oob-send may crash the router.

Remediation

Restrict UDP 1701 exposure; disable L2TP WAN if not required.
Monitor D-Link advisories for firmware beyond A1_102b07.
Replace or segment legacy routers on internet-facing paths.

Legal and ethical use

Authorized testing only. Do not send --oob-send against production networks you do not own.