CVE-2026-94036

8.8 HIGH

Published 2026-09-20 · Updated 2026-09-21

AI risk analysis

Summary: A security flaw in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402 allows local network attackers to exploit improper access controls through manipulation of the passwd_set argument.
Exploitability: Exploitation requires local network access and manipulation of the passwd_set argument, making it moderately difficult to exploit.
Blast radius: If exploited, the attack could lead to unauthorized access and control over the router, potentially leading to further network compromise.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to D-Link DIR-X1860 and DIR-X1860Z version 1.0.2.220120.165402 or later.

local-privilege-escalationaccess-controlrouter

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-266, CWE-284

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.