An unauthenticated user already on the local network can set a new administrator password on a vulnerable D-Link DIR-X1860Z router, then sign in through the normal login flow. The same exposed management surface can disclose wireless credentials. D-Link’s August 26 security announcement identifies a fixed firmware build, making the issue actionable for current router inventories even though the advisory is now ten days old.
The scope is narrower than an internet-reachable router takeover. D-Link says the user needs local-network access, the affected DIR-X1860Z is a non-US product, and the company has not reported exploitation in the wild. It did not quantify how many routers run the affected firmware.
Local Access Reaches Router Control
The issue sits in the OpenWrt-based ubus JSON-RPC management interface exposed at TCP port 23355 and /ubus. On DIR-X1860Z hardware revision A1/V1.0 running firmware V1.0.2.220120.165402, some privileged routerd methods lacked the expected authentication boundary. Security researcher Lim Kar Joon reported the issue to D-Link on August 18.
The first path begins with routerd.passwd_set. D-Link says, “An unauthenticated user with local network access could potentially use the affected interface to establish a new administrator password.” The user can then authenticate normally and receive an administrative ubus_rpc_session. The flaw therefore turns one foothold on the same network into control of the router’s authenticated management plane.
A second path uses routerd.wificfg_get with routerd.get_rand_key. D-Link says that interaction can recover wireless configuration information, including Wi-Fi credentials. Those are separate outcomes from the same exposed service: one changes who can administer the router, while the other reveals a secret that can preserve local access.
Long description
An untrusted device on the local network reaches the DIR-X1860Z management interface on TCP port 23355 at /ubus. That service branches to routerd.passwd_set, which can establish a new administrator password and lead to a normal authenticated ubus session, and to routerd.wificfg_get plus routerd.get_rand_key, which can reveal wireless configuration and Wi-Fi credentials. Both branches are limited to the reported firmware and local-network access described by D-Link.
Model Names Change the Fix
D-Link resolved both reported conditions in DIR-X1860Z firmware V1.0.7.260821.161908, finalized on August 25. That is the first fixed build named in the advisory, and the company recommends it or a later release for the matching DIR-X1860Z hardware.
Firmware packages are model-specific.
The similarly named DIR-X1860 is a different case. D-Link lists every hardware revision of that model as end-of-life and end-of-service, with no fixed release available. Its recommendation is retirement and replacement with a supported router. The company expressly separates that product from the active DIR-X1860Z and warns against crossing firmware between the two names.
No CVE identifier or authoritative CVSS score had been assigned when D-Link published the notice. The vendor’s affected-model table is the useful scope authority: DIR-X1860Z A1/V1.0 on the reported firmware receives an update, while DIR-X1860 receives a replacement decision.
Verify the Reported Firmware
Inventory the product label and administration interface before changing firmware. Confirm the device is DIR-X1860Z, hardware A1/V1.0, and identify any unit reporting V1.0.2.220120.165402. Patch that model with V1.0.7.260821.161908 or a later supported release from the applicable regional D-Link organization. Isolate unsupported DIR-X1860 devices from sensitive local networks while they are replaced. Preserve router administration and network telemetry if prior abuse is a concern, because D-Link published no logs, request signatures, or other reliable method for recognizing historical use of the exposed methods.
The vendor’s verification test is specific: reopen the router’s administration interface after installation and check the firmware value. The expected result is V1.0.7.260821.161908 or later on a DIR-X1860Z. A DIR-X1860 inventory entry should instead resolve to a documented replacement action.
This advisory is a reminder that “local” is an access condition, not a harmless consequence. Guest devices, compromised endpoints, and anyone holding an old Wi-Fi key already occupy that side of the boundary. Once a router accepts a new administrator password there, the trust decision has moved from the network edge into the attacker’s hands.