VulnerabilityDeferred

CVE-2026-86295

A vulnerability was found in D-Link DIR-895L A1_102b07.

MEDIUM 5.5EPSS 1.72%

Does this matter?

Lower severity and a low EPSS score (1.72%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. The manipulation of the argument Hostname results in command injection. The attack can be executed remotely. The exploit has been made public and could be used.

CVSS 4.0: 5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 1.72% probability · 76th percentile
CISA KEV: Not listed
Weakness: CWE-74, CWE-77
Source: cna@vuldb.com

References

https://tzh00203.notion.site/D-Link-DIR-895L-Command-Injection-in-udhcpd-sendACK-TR-069-Host-Helper-33cb5c52018a80aaaa5be16a761ff457
https://vuldb.com/cve/CVE-2026-86295
https://vuldb.com/submit/906296
https://vuldb.com/vuln/399457
https://vuldb.com/vuln/399457/cti
https://www.dlink.com/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.