High severity8.8NVD Advisory· Published Sep 20, 2026· Updated Sep 21, 2026

CVE-2026-94036

Description

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dlink/DIR-X1860llm-create
Range: <=1.0.2.220120.165402
Dlink/DIR-X1860Zllm-create
Range: <=1.0.2.220120.165402

Patches

Vulnerability mechanics

References

pastebin.com/gzKNCCPVnvd
supportannouncement.us.dlink.com/security/publication.aspxnvd
vuldb.com/cve/CVE-2026-94036nvd
vuldb.com/submit/947565nvd
vuldb.com/vuln/407965nvd
vuldb.com/vuln/407965/ctinvd
www.dlink.comnvd

News mentions

D-Link: Seven Vulnerabilities Including RCE Disclosed in Single Batch
Vypr Intelligence · Sep 25, 2026

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000