{"schemaVersion":3,"id":"CVE-2026-100740","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may be used.","dates":{"published":"2026-09-27T00:45:14.034Z","modified":"2026-09-28T14:39:06.971Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.9,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":9.4,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":9.9,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"CVE.org","score":9,"severity":"high","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.6,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9,"severity":"high","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00453,"percentile":0.37998,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-27T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00453,"percentile":0.37998}],"last30":[{"date":"2026-09-27T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00453,"percentile":0.37998}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_7317F3299D5C4155","name":"Exploit Reference (tzh00203.notion.site)","source":"reference","url":"https://tzh00203.notion.site/D-Link-DIR-895L-L2TP-Host-Name-AVP-Out-of-Bounds-Write-33cb5c52018a8061b139cacc39d58fff","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"},{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"d-link","product":"dir-895l_firmware","name":"dir-895l firmware","label":"dir-895l_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"A1_102b07","noFixRecorded":false,"fixedIn":null}],"versionsText":"A1_102b07","eol":null,"hubHref":"/vendor/d-link/dir-895l"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://vuldb.com/vuln/410614","label":"vuldb.com/vuln/410614","hostname":"vuldb.com","tags":["VDB Entry","Technical Description"]},{"url":"https://vuldb.com/vuln/410614/cti","label":"vuldb.com/vuln/410614/cti","hostname":"vuldb.com","tags":["Signature","Permissions Required"]},{"url":"https://vuldb.com/cve/CVE-2026-100740","label":"vuldb.com/cve/CVE-2026-100740","hostname":"vuldb.com","tags":["Third Party Advisory"]},{"url":"https://vuldb.com/submit/906303","label":"vuldb.com/submit/906303","hostname":"vuldb.com","tags":["Third Party Advisory"]},{"url":"https://tzh00203.notion.site/D-Link-DIR-895L-L2TP-Host-Name-AVP-Out-of-Bounds-Write-33cb5c52018a8061b139cacc39d58fff","label":"tzh00203.notion.site/D-Link-DIR-895L-L2TP-Host-Name-AVP-Out-of-Bounds-Write-33cb5c52018a8061b139cacc39d58fff","hostname":"tzh00203.notion.site","tags":["Exploit"]},{"url":"https://www.dlink.com/","label":"www.dlink.com","hostname":"www.dlink.com","tags":["Product"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-27T00:45:14.034Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-28T14:39:06.971Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:11:47.112Z","stale":false,"partial":false}}