D-Link has issued a firmware patch to fix severe security holes in its DIR-X1860Z router that allow unauthorized users on the local network to alter the admin password and access Wi-Fi credentials without logging in. These vulnerabilities stem from flaws in an exposed management interface based on OpenWrt, specifically the ubus JSON-RPC services operating via TCP port 23355.
The errors were publicly disclosed in advisory SAP10513 on August 26, 2026, following an initial report submitted August 18 by researcher Lim Kar Joon. The affected hardware version is the non-US DIR-X1860Z, revision A1, running firmware version V1.0.2.220120.165402.
What the vulnerabilities enable
One flaw is in the “routerd.passwd_set” method; when exploited, it allows an attacker already inside the local network to change the router’s administrator password without authentication. Once the password has been reset, full administrative access can be gained through the usual login process, permitting control over system settings, network services, and access rules.
The second issue involves “routerd.wificfg_get” and “routerd.get_rand_key” methods. These allow an unauthenticated user to retrieve wireless configuration data—including your Wi-Fi password—through the same ubus interface. Stolen credentials mean an attacker can re-enter the network later or share access with others.
Patch, product status, and what users should do
D-Link addressed both flaws in firmware version V1.0.7.260821.161908, released August 25, 2026. Users whose routers match the DIR-X1860Z model, hardware revision A1, and the vulnerable firmware should upgrade immediately.
The company cautions against firmware mismatches: installing DIR-X1860 firmware onto a DIR-X1860Z device—or vice versa—can cause issues. The DIR-X1860 model is outdated and has reached end-of-life; it no longer receives security patches and should be replaced by a supported router.
No CVE IDs, CVSS scores, or CWE classifications have been published for these flaws yet. D-Link classifies them broadly under improper access control, improper authorization, and information disclosure.
Analysis: These flaws highlight just how dangerous exposed management interfaces can be when the authentication is misconfigured or entirely missing. For users, routers often go unpatched—especially models that reach end-of-life. Moving forward, always verify firmware version and hardware revision before updating. Consumers should prefer routers still under active support. Manufacturers must ensure that internal APIs—such as those for device management—are never exposed without strong authentication, encryption, and thorough security review. Robust firmware update systems aren’t optional—they’re essential to keeping day-to-day network security from being compromised.
