8.8High
CVE-2026-94036D-Link DIR-X1860/DIR-X1860Z routerd ubus access control
Description
A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| D-Link | DIR-X1860 | 1.0.2.220120.165402 | |
| D-Link | DIR-X1860Z | 1.0.2.220120.165402 |
References and patches
- VDB-407965 | D-Link DIR-X1860/DIR-X1860Z routerd ubus access control vdb-entrytechnical-description
- VDB-407965 | CTI Indicators (IOB, IOC, TTP, IOA) signature
- CVE-2026-94036 | CVE Analysis and Report third-party-advisory
- Submit #947565 | D-Link DIR-X1860Z 1.0.2.220120.165402 Improper Access Controls third-party-advisory
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10513
- https://pastebin.com/gzKNCCPV broken-linkexploit
- https://www.dlink.com/ product