CVE-2026-94036: D-Link Router Authentication Bypass
TL;DR - CVE-2026-94036 allows local-network attackers to invoke a privileged password-change method without proper authentication. - DIR-X1860Z users should upgrade to V1.0.7.260821.161908 or later; DIR-X1860 users should replace the end-of-life device. - A public exploit is reported, but confirmed in-the-wild exploitation is not currently documented by CISA KEV.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2026-94036 |
| CVSS | 8.8 High |
| Attack vector | Local network |
| Authentication required | No authentication for the affected method |
| Affected products | D-Link DIR-X1860 and DIR-X1860Z |
| Affected firmware | Up to and including 1.0.2.220120.165402 |
| Reported interface | OpenWrt-based ubus JSON-RPC interface on TCP port 23355, endpoint /ubus |
| Patch status | Yes for DIR-X1860Z; no identified patch for DIR-X1860 |
| Fixed version | DIR-X1860Z firmware V1.0.7.260821.161908 |
| Public exploit | Reported by NVD |
| CISA KEV status | Not currently listed |
This is a high-severity authorization flaw in the management interface used by affected D-Link routers. An attacker does not need an existing administrator account to invoke the reported password-setting method, but the attacker must be able to reach the router from its local network or another network path where the management interface is exposed.
The remediation path differs by model. D-Link identifies firmware V1.0.7.260821.161908 as fixing the issue on the DIR-X1860Z. D-Link also states that the non-US DIR-X1860 has reached end of life and end of service, so administrators should not assume that a firmware update will become available for that model.
What Is CVE-2026-94036?
CVE-2026-94036 is an improper access-control vulnerability affecting the OpenWrt-based ubus JSON-RPC management interface and the routerd service. The reported interface is available at /ubus, with TCP port 23355 identified in the available technical information. The vulnerable operation is associated with the routerd.passwd_set method.
The method is intended to perform a privileged administrator-password change. According to the vendor’s advisory, the affected interface permits certain privileged routerd methods to be accessed without proper authentication. An unauthenticated local-network user can therefore submit a request that changes the router administrator password, then use the new credentials to obtain an authenticated administrative ubus_rpc_session.
The issue is not described as an Internet-wide unauthenticated vulnerability. Its attack requirement is local-network access, although that boundary can still be broad in homes, small offices, guest wireless networks, shared buildings, managed service environments, or flat enterprise networks. D-Link also describes related exposure of wireless configuration information through the same management interface.
Technical Notes
The reported method and endpoint are:
Service: routerd
Method: passwd_set
Interface: /ubus
Port: TCP 23355
The available records do not provide a complete request body, a verified exploit script, or a reliable protocol-level description of every affected ubus method. Defenders should therefore avoid relying on a single request format as the only detection condition. Monitoring access to /ubus, password changes, new administrative sessions, and unexpected wireless-configuration reads provides broader coverage.
Who Is Affected?
The affected products are D-Link DIR-X1860 and DIR-X1860Z routers running firmware up to and including 1.0.2.220120.165402. The NVD record describes both product families as affected through that version. Administrators should inventory the exact model and firmware string rather than treating all DIR-X1860-series devices as interchangeable.
For the DIR-X1860Z, D-Link identifies the vulnerable firmware as V1.0.2.220120.165402 and states that the issue is addressed in V1.0.7.260821.161908. A later vendor-provided version should also be acceptable if it supersedes that release. Confirm the installed firmware after updating.
The non-US DIR-X1860 requires a different response. D-Link states that the DIR-X1860 has reached end of life and end of service across all hardware revisions and no longer receives security updates or patches. No fixed firmware version is identified for that model. Treat affected DIR-X1860 units as unsupported and replace them with a currently supported router.
CVSS Score Breakdown
CVE-2026-94036 has a CVSS base score of 8.8, rated High. The supplied NVD result does not expose the vector string, so the exact individual metric values must not be inferred. In particular, the precise confidentiality, integrity, availability, scope, and user-interaction selections are not available in the retrieved record.
The available facts nevertheless explain why the score is operationally significant. The attack originates from a local network, requires no existing authentication at the vulnerable method, and can enable an administrator-password change. Successful exploitation can lead to authenticated administrative access, allowing an attacker to alter router configuration and potentially observe or control network traffic subject to the device’s capabilities.
Because the vector is unavailable, organizations should record the score as 8.8 High while preserving the limitation that a full metric-by-metric breakdown cannot be independently reproduced from the supplied NVD data. Risk decisions should focus on exposure: whether untrusted users can reach the router, whether TCP port 23355 is exposed beyond a trusted management segment, and whether the device controls a sensitive network boundary.
Exploitation Status
The NVD description states that a public exploit has been released. The NVD record includes a Pastebin reference, but that URL returned HTTP 404 during retrieval and its contents could not be independently verified. No verified GitHub proof-of-concept repository was identified in the available research.
Confirmed active exploitation in the wild has not been established in the supplied evidence. CVE-2026-94036 is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and there is no CISA KEV ransomware-campaign designation for this CVE. The absence of a KEV listing does not prove that exploitation is absent; it means that CISA has not cataloged the vulnerability as a known exploited vulnerability at the time of assessment.
The appropriate operational classification is therefore: public exploit reported, but confirmed in-the-wild exploitation not currently verified. Local-network access requirements reduce Internet-wide exposure, but public exploit availability increases the likelihood of opportunistic attacks against poorly segmented networks.
How to Detect CVE-2026-94036
Start with an asset inventory query for DIR-X1860 and DIR-X1860Z devices, recording model, hardware revision, firmware version, management IP address, and network location. Any device at or below 1.0.2.220120.165402 should be treated as affected. Also check whether TCP port 23355 is reachable from guest, wireless, user, or Internet-facing segments.
Organizations developing a broader vulnerability-management process can review this vulnerability scanning glossary for related terminology and assessment concepts.
Look for unexplained administrator-password changes, unexpected new administrative sessions, and access to /ubus from clients that do not normally manage network infrastructure. A password change followed shortly by an authenticated administrative session is particularly suspicious. Since vendor-specific log field names are not provided, normalize available router logs into source IP, destination port, HTTP path, method name, result code, account, and timestamp fields.
Technical Notes
A network scanner can identify exposed management services from an authorized assessment host:
nmap -sT -Pn -p 23355 --open 192.168.1.0/24
Use the router’s own logs or a network sensor to search for the reported endpoint and method. Example SIEM logic, using generic field names, is:
(dst_port = 23355 AND url_path = "/ubus")
OR (service = "routerd" AND method = "passwd_set")
OR (event_type = "admin_password_change")
A representative log pattern to investigate is:
src_ip=<unexpected_local_client> dst_port=23355 path=/ubus method=routerd.passwd_set
This is a detection pattern, not a claim about the exact vendor log format. Validate field names and normal administrative sources in each environment. Do not send password-change requests as a test against production devices.
Mitigation and Patching
For DIR-X1860Z devices, upgrade to V1.0.7.260821.161908 or a later firmware version published by D-Link. Use the vendor’s supported firmware-update process, verify the downloaded image through the vendor’s published mechanism where available, export configuration backups carefully, and confirm the running firmware after reboot.
Rotate administrative credentials after patching, particularly if the device was reachable by untrusted local users. A reputable password manager such as Try 1Password → can help administrators generate and securely store unique replacement credentials.
For DIR-X1860 devices, D-Link identifies the product as end of life and recommends retirement and replacement. Because no security patch is identified, do not treat a password reset or factory reset as a permanent fix. Replace the router, migrate the configuration to supported equipment, and rotate credentials that may have been exposed through the vulnerable device.
Technical Notes
If immediate replacement or patching is not possible, restrict TCP port 23355 to a trusted management host or management VLAN. On a Linux firewall protecting the router segment, an example temporary policy is:
sudo iptables -I FORWARD 1 -p tcp --dport 23355 -s 192.0.2.10 -j ACCEPT
sudo iptables -I FORWARD 2 -p tcp --dport 23355 -j DROP
Replace 192.0.2.10 with an authorized management address and adapt the chain, interface, and persistence mechanism to the firewall architecture. Do not apply this example blindly to the router itself; vendor firmware may use different firewall tooling and may overwrite manual rules. The preferred control is to block the port at the network boundary and permit management only from a dedicated trusted segment.
After remediation, review the configuration for unauthorized DNS, port-forwarding, wireless, VPN, and administrator-account changes. If unexplained changes are present, isolate the device, preserve available logs, perform a vendor-supported reset or replacement, and rotate credentials from a clean management system.
Incident Response Checklist
If you suspect exploitation of CVE-2026-94036:
- Disconnect the affected router from untrusted network segments where practical.
- Preserve router logs, firewall logs, DHCP records, and authentication events.
- Identify unauthorized administrator-password, DNS, wireless, VPN, and port-forwarding changes.
- Determine whether TCP port 23355 was reachable from guest, wireless, user, or external networks.
- Patch the DIR-X1860Z or replace the unsupported DIR-X1860.
- Rotate router administrator credentials and any credentials reused elsewhere.
- Review connected systems for suspicious DNS responses, unexpected management traffic, or follow-on activity.
- Restore known-good configuration only after confirming that the replacement or updated device is secure.
References
The primary technical sources are the NVD record and D-Link’s security advisory. The NVD record provides the CVE description, affected products, CVSS score, local-network requirement, and public-exploit statement. D-Link’s advisory provides the DIR-X1860Z fixed firmware and the end-of-life status of the DIR-X1860.
- NVD: CVE-2026-94036
- D-Link Security Advisory SAP10513
- NVD-listed Pastebin reference
- VulDB: CVE-2026-94036
- VulDB vulnerability reference
The Pastebin reference should be treated as unverified because it returned HTTP 404 during retrieval. Likewise, the absence of a verified GitHub proof of concept or CISA KEV listing should not be interpreted as evidence that exploitation is impossible. The actionable priority remains to patch supported DIR-X1860Z devices, replace unsupported DIR-X1860 devices, and restrict access to the affected management interface.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.