Reported by 2 outlets
D-Link DIR-X1860Z Flaws Enable Unauthenticated Admin Password Reset and Wi-Fi Credential Theft
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
D-Link DIR-X1860Z Flaws Enable Unauthenticated Admin Password Reset and Wi-Fi Credential Theft
gbhackers.com · 43d ago · August 31st, 2026
D-Link has released a security update for the DIR-X1860Z router after researchers discovered vulnerabilities that could enable an unauthenticated attacker on the local network to reset the administrator password and retrieve wireless configuration information, including Wi-Fi credentials. The vulnerabilities affect the non-US DIR-X1860Z hardware revision A1/V1.0 running firmware version V1.0.2.220120.165402. D-Link addressed these issues in […] The post D-Link DIR-X1860Z Flaws Enable Unauthenticated Admin Password Reset and Wi-Fi Credential Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
D-Link DIR-X1860Z Flaws Enable Unauthenticated Admin Password Reset and Wi-Fi Credential Theft
cyberpress.org · 43d ago · August 31st, 2026
The issues affect hardware revision A1/V1.0 running firmware V1.0.2.220120.165402 and stem from insufficient authentication controls in the device’s OpenWrt-based ubus JSON-RPC management interface. The primary vulnerability involves the routerd.passwd_set method exposed through the router’s ubus JSON-RPC interface. D-Link DIR-X1860Z Flaws According to D-Link, an attacker connected to the same local network could invoke the privileged method without proper authentication and establish a new administrator password. After changing the password, the attacker could log in through the router’s standard administration workflow and obtain an authenticated administrative ubus_rpc_session . This access could give the intruder control over router settings, enabling further network manipulation such as changing DNS settings , modifying firewall rules, altering port-forwarding configurations, or locking legitimate owners out of their devices. The affected management service is accessible through TCP port 23355 at the /ubus endpoint. While exploitation requires local-network access, the condition remains significant in environments where attackers can join an exposed wireless network, compromise another endpoint on the LAN, or gain physical access to an