CVE-2026-94050: D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure
A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 is able to address this issue. It is suggested to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
D-Link DIR-X1860Z (ubus JSON-RPC interface routerd.get_rand_key)to a version that resolves this vulnerability.Fixed in 1.0.7.260821.161908
Event History
Frequently Asked Questions
Which devices are affected?
D-Link DIR-X1860Z devices running versions up to 1.0.2.220120.165402 are affected. The issue is in the ubus JSON-RPC interface functions routerd.wificfg_get and routerd.get_rand_key.
Does exploitation require Internet access or authentication?
The attack must be performed from within the local network. The provided severity vector indicates no privileges or user interaction are required.
What is the remediation?
Upgrade to version 1.0.7.260821.161908, which addresses the issue. The affected products are no longer supported by the maintainer.