# CVE-2026-94036: D-Link DIR-X1860Z improper access control in ubus management interface

Source: https://junglewise.ai/threats/cve-2026-94036-a-security-flaw-has-been-discovered-in-d-link-dir-x1860-and-dir  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-20. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-94036 · Severity: high · CVSS 8.8 · Published 2026-09-20

D-Link DIR-X1860Z routers contain a critical flaw in their network management interface that allows attackers on the local network to change the administrator password without authentication. An attacker exploiting this vulnerability can take complete control of the device, modify wireless and network settings, and access sensitive configuration data including Wi-Fi passwords.

Vendors: [D-Link](https://junglewise.ai/threats/vendors/d-link).

## Quick answers

**Is CVE-2026-94036 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94036 being exploited in the wild.

**How severe is CVE-2026-94036?** High severity, with a CVSS score of 8.8, published 20 September 2026.

**Which products and versions are affected?** D-Link DIR-X1860Z up to V1.0.2.220120.165402.

**Is there a fix for CVE-2026-94036?** A patch was published on 2026-08-25: Fixed firmware V1.0.7.260821.161908 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94036 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-94036?** Check whether you run D-Link DIR-X1860Z at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ubus JSON-RPC management interface on the affected firmware fails to properly enforce access controls on the routerd.passwd_set method and related privileged methods, allowing unauthenticated requests from the local network to invoke administrative functions. The vulnerability is compounded by exposure of the AES encryption key through routerd.get_rand_key, enabling decryption and modification of password parameters. The flaw has been patched in firmware V1.0.7.260821.161908.

## Affected products

- D-Link DIR-X1860Z up to V1.0.2.220120.165402

## Timeline

- 2026-08-25: disclosed: Proof of concept exploit published on Pastebin
- 2026-08-25: patched: Fixed firmware V1.0.7.260821.161908 released
- 2026-08-26: advisory: D-Link security announcement SAP10513 published

## References

- [https://pastebin.com/gzKNCCPV](https://pastebin.com/gzKNCCPV)
- [https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10513](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10513)

## Related threats

- [D-Link DIR-X1860Z information disclosure in ubus JSON-RPC](https://junglewise.ai/threats/cve-2026-94050-a-vulnerability-has-been-found-in-d-link-dir-x1860z-up-to-1-0-2)