ET EXPLOIT D-Link udhcpd option 125, Suboption 1-3 Buffer Overflow Attempt (CVE-2026-86296)

alert udp any any -> any 67 (
    msg:"ET EXPLOIT D-Link udhcpd option 125, Suboption 1-3 Buffer Overflow Attempt (CVE-2026-86296)";
    flow:stateless,to_server;
    content:"|63 82 53 63|";
    content:"|35|"; within:1;
    content:"|7d|"; distance:0;
    content:"|e9 0d 00 00|"; within:5; fast_pattern;
    pcre:"/^.*(?:\x01|\x02|\x03)/R";
    reference:url,tzh00203.notion.site/D-Link-DIR-822A-Stack-Overflow-in-udhcpd-TR-111-Option-125-Parsing-33cb5c52018a80238b80e89e7c7c68f0;
    reference:cve,2026-86296;
    classtype:web-application-attack;
    sid:2071956; rev:1;
    metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_09_08, cve CVE_2026_86296, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2026_09_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
    target:dest_ip;
)