alert udp any any -> any 67 (msg:"ET EXPLOIT D-Link udhcpd option 125, Suboption 1-3 Buffer Overflow Attempt (CVE-2026-86296)"; flow:stateless,to_server; content:"|63 82 53 63|"; content:"|35|"; within:1; content:"|7d|"; distance:0; content:"|e9 0d 00 00|"; within:5; fast_pattern; pcre:"/^.*(?:\x01|\x02|\x03)/R"; reference:url,tzh00203.notion.site/D-Link-DIR-822A-Stack-Overflow-in-udhcpd-TR-111-Option-125-Parsing-33cb5c52018a80238b80e89e7c7c68f0; reference:cve,2026-86296; classtype:web-application-attack; sid:2071956; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_09_08, cve CVE_2026_86296, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2026_09_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)