This vulnerability in D-Link DIR-895L's udhcpcd component allows remote command injection via manipulation of the Hostname argument in the sendACK function. The flaw exists in the file udhcpcd/serverpacket.c and can be exploited without authentication. While an exploit is publicly available, no official fix or patch has been confirmed by the vendor as of the publication date. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, availability, scope, and security requirements.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising device integrity and control. The impact is rated medium severity with limited but non-negligible impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the device and monitoring for suspicious activity related to this vulnerability.