D-Link DIR-605 L2TP Parser Off-by-One Memory Vulnerability

CVE-2026-86297 is a remote off-by-one error in the L2TP (Layer 2 Tunneling Protocol) control message parser of D-Link DIR-605 B1 routers. The vulnerability exists in the tunnel_set_params function where improper handling of the peer_hostname argument creates a one-byte buffer overflow condition. This affects network infrastructure devices commonly deployed in small office and home environments, making any organization relying on these routers for VPN termination or L2TP services potentially at risk. While exploitation is complex and requires deep protocol knowledge, the public availability of exploit code increases the likelihood of weaponization.

While this CVE does not map to specific MITRE ATT&CK techniques in public threat intelligence, Casky's 754 mapped security skills enable practitioners to identify attack precursors through behavioral analysis of L2TP protocol anomalies. Extended reasoning across Casky's skill library would flag indicators such as malformed tunnel parameter parsing attempts, unexpected peer_hostname string lengths during L2TP negotiation, and memory access patterns consistent with off-by-one exploitation. Practitioners monitoring DIR-605 devices would receive findings highlighting unusual L2TP control message sequences, failed tunnel establishment with oversized hostname parameters, and potential code execution attempts—allowing detection of pre-exploitation reconnaissance or active compromise before successful payload delivery occurs.