CVE-2026-86295: Command Injection in D-Link DIR-895L

This vulnerability affects the D-Link DIR-895L A1_102b07 firmware version in the udhcpcd component's sendACK function. An attacker can manipulate the Hostname argument to inject and execute arbitrary commands remotely. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and partial impacts on confidentiality, integrity, availability, scope, and security requirements. No patch or vendor advisory information is provided, and no known exploits in the wild have been reported.

Successful exploitation could allow remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the device's operation. The medium severity score reflects the significant but not critical impact due to partial impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device and monitor for unusual activity related to the Hostname parameter in network traffic. Avoid exposing the device to untrusted networks.