CVE-2026-94036: D-Link DIR-X1860 Auth Bypass Vulnerability

CVE-2026-94036 is an authentication bypass vulnerability in D-Link DIR-X1860 and DIR-X1860Z routers affecting the routerd component. Attackers on the local network can exploit improper access controls to bypass authentication. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-94036 Overview

CVE-2026-94036 is an improper access control vulnerability [CWE-266] affecting D-Link DIR-X1860 and DIR-X1860Z routers running firmware up to 1.0.2.220120.165402. The flaw resides in an unknown function of the /ubus endpoint within the routerd component. Attackers can manipulate the passwd_set argument to bypass access controls on the device. Exploitation requires adjacent network access, meaning the attacker must be on the local network segment. A public exploit has been released, increasing the risk of opportunistic attacks against exposed devices.

Critical Impact
Successful exploitation allows an attacker on the local network to abuse the passwd_set operation in routerd, compromising device confidentiality, integrity, and availability without authentication.

Affected Products

D-Link DIR-X1860 firmware up to 1.0.2.220120.165402
D-Link DIR-X1860Z firmware up to 1.0.2.220120.165402
routerd component exposing the /ubus interface

Discovery Timeline

2026-09-20 - CVE-2026-94036 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94036

Vulnerability Analysis

The vulnerability affects the routerd daemon on D-Link DIR-X1860 series devices. The /ubus endpoint exposes functionality that processes the passwd_set argument without enforcing proper access controls [CWE-266]. An attacker on the adjacent network can invoke this operation to alter privileged state on the router. Because the daemon operates with elevated privileges, abuse of the exposed method translates directly into router-level compromise. Public disclosure of an exploit lowers the barrier to weaponization against unpatched devices.

Root Cause

The root cause is improper privilege management within the routerd handler that services /ubus requests. The affected code path accepts the passwd_set argument from callers that should not be authorized to invoke it. The absence of proper authorization checks allows an unauthenticated adjacent attacker to trigger sensitive functionality reserved for privileged users.

Attack Vector

Exploitation requires network adjacency, such as a wireless client on the router's LAN or a device reachable on the same broadcast domain. The attacker crafts a request to the /ubus endpoint that manipulates the passwd_set parameter. No authentication or user interaction is required to trigger the flaw. See the D-Link Security Advisory SAP10513 and VulDB entry for CVE-2026-94036 for additional technical context.

Detection Methods for CVE-2026-94036

Indicators of Compromise

Unexpected requests targeting the /ubus endpoint on DIR-X1860 or DIR-X1860Z devices from LAN or Wi-Fi clients.
Unauthorized changes to router administrative credentials or configuration state.
New or unfamiliar wireless clients associated with the router prior to configuration changes.

Detection Strategies

Inspect router administrative interfaces and logs for unexplained passwd_set operations invoked via routerd.
Monitor LAN traffic for HTTP or ubus-formatted requests targeting the /ubus path on affected D-Link devices.
Correlate router configuration changes with recent client associations on the wireless network.

Monitoring Recommendations

Forward router syslog data to a central logging system to preserve evidence of local exploitation attempts.
Alert on administrator password changes originating from non-management network segments.
Track firmware versions across managed D-Link devices to identify unpatched DIR-X1860 and DIR-X1860Z units.

How to Mitigate CVE-2026-94036

Immediate Actions Required

Consult the D-Link Security Advisory SAP10513 and apply vendor-provided firmware once available.
Restrict administrative access to the router to trusted, wired management segments.
Rotate router administrator credentials and Wi-Fi pre-shared keys after patching.

Patch Information

Refer to the D-Link Security Advisory SAP10513 for the current patch status of DIR-X1860 and DIR-X1860Z. Devices remain vulnerable until firmware newer than 1.0.2.220120.165402 is installed. Additional metadata is available from the VulDB record.

Workarounds

Segment the router's management interface onto a dedicated VLAN inaccessible to general Wi-Fi clients.
Disable guest and untrusted wireless networks until firmware is updated.
Replace end-of-support DIR-X1860 hardware if the vendor does not provide a fix.