CVE-2026-86297: Off-by-One in D-Link DIR-605

CVE-2026-86297 is an off-by-one vulnerability in the tunnel_set_params function within the L2TP Control Message Parser of the D-Link DIR-605 B1v202WWB03 router. The vulnerability arises from improper handling of the peer_hostname argument, which can be manipulated remotely to cause a memory boundary error. This flaw has a CVSS 3.1 score of 8.1 (high severity) with network attack vector, high complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Public exploit code exists, but exploitation is difficult and no active exploitation is known.

Successful exploitation can lead to high impact on confidentiality, integrity, and availability of the affected device. The vulnerability allows remote attackers to potentially execute unauthorized actions or cause denial of service due to the off-by-one memory error. However, exploitation complexity is high, reducing the likelihood of widespread attacks. No active exploitation in the wild is currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Due to the high complexity of exploitation, immediate urgent action may not be required, but monitoring vendor channels for updates is recommended.