Is CVE-2026-86297 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86297?

CVE-2026-86297 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-86297

Description

A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.alpha/l2tp/tunnel.c of the component L2TP Control Message Parser. Such manipulation of the argument peer_hostname leads to off-by-one. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit is publicly available and might be used.