CVE-2026-94036: D-Link Dir-x1860

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

Affected products

• D-Link Dir-x1860: version 1.0.2.220120.165402 only
• D-Link Dir-x1860z: version 1.0.2.220120.165402 only

Published 2026-09-20. Last modified 2026-09-21.