CVE-2026-94036: D-Link DIR-X1860/DIR-X1860Z routerd ubus access control
A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwdset results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
Which devices and versions are affected?
D-Link DIR-X1860 and DIR-X1860Z routers are affected through version 1.0.2.220120.165402.
Who can exploit this issue?
An attacker must be able to originate the attack from the local network. The CVSS vector indicates no privileges or user interaction are required.
Is exploit code available?
Yes. The exploit has been released publicly and may be used in attacks.
What is the potential impact of successful exploitation?
The issue is rated high severity and has high confidentiality, integrity, and availability impact in the supplied CVSS vector.