PT-2026-86568

CVE-2026-86295

Published

2026-09-06

Updated

2026-09-07

Description by

CVSS 3.1

8.3

High

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions D-Link DIR-895L version A1 102b07

Description A remote command injection issue exists within the udhcpcd component. The flaw is located in the sendACK() function of the udhcpcd/serverpacket.c file. An attacker can execute arbitrary commands remotely by manipulating the Hostname argument.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Tian

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers