D-Link has disclosed two security vulnerabilities in the DIR-X1860Z wireless router that could allow an unauthenticated attacker with access to the local network to compromise router administration and expose Wi-Fi credentials. The flaws were disclosed in D-Link advisory SAP10513, published on August 26, 2026, following a report from security researcher on August 18. The affected device is the non-US DIR-X1860Z, hardware revision A1, running firmware V1.0.2.220120.165402. Both vulnerabilities reside in the router’s OpenWrt-based ubus JSON-RPC management interface, which is exposed through TCP port 23355 and the /ubus endpoint.

The first vulnerability affects the routerd.passwd_set method, which could be accessed without proper authentication on the vulnerable firmware. An attacker already connected to the local network could exploit this weakness to change the router’s administrator password. Once the password was changed, the attacker could log in through the normal router management interface and obtain an authenticated ubus administrative session. This could provide extensive control over router management functions, allowing the attacker to modify network settings, services, connected-device access rules, and other administrative configurations.

The second vulnerability is an information-disclosure flaw involving the same ubus management interface. D-Link identified the affected functions as routerd wificfg_get and routerd.get_rand_key, which could be abused by an unauthorized local-network attacker to retrieve wireless configuration information, potentially including Wi-Fi credentials. Theft of these credentials could allow attackers to reconnect to the wireless network later, maintain unauthorized access, or share the credentials with other individuals. D-Link classified the issues as improper access control, improper authorization, and information disclosure; at the time of publication, no CVE, CWE classification, or official CVSS score had been assigned.

D-Link has addressed both vulnerabilities in DIR-X1860Z firmware V1.0.7.260821.161908, finalized on August 25, 2026, and recommends that affected users upgrade to this version or a newer release. Administrators should verify both the DIR-X1860Z model and hardware revision before updating, as D-Link specifically warns against installing DIR-X1860 firmware on DIR-X1860Z devices or vice versa. The similarly named DIR-X1860 is a separate non-US product that has reached end of life and end of service and will no longer receive security updates; users of that model should replace it with a supported router.