CVE-2026-94050 D-Link CVE debrief

Who should care

Network administrators and security teams responsible for D-Link DIR-X1860Z routers should assess exposure and prioritize upgrading affected devices. They should also verify the current firmware version of D-Link DIR-X1860Z devices and limit access to the ubus JSON-RPC interface. Additionally, they should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-94050 is a medium-severity vulnerability affecting D-Link DIR-X1860Z routers, allowing for information disclosure. Network administrators and security teams should assess exposure and prioritize upgrading affected devices.

• Information disclosure may occur if the vulnerability is exploited
• Local network access is required for exploitation
• Upgrade to firmware version 1.0.7.260821.161908 is recommended

Technical summary

The D-Link DIR-X1860Z router's ubus JSON-RPC interface is vulnerable to information disclosure. The function routerd.wificfg_get/routerd.get_rand_key is affected, and exploitation requires local network access. Upgrading to firmware version 1.0.7.260821.161908 addresses this issue. The vulnerability has a medium severity with a CVSS score of 5.3. Affected products are no longer supported by the maintainer, which may impact mitigation efforts. Network administrators and security teams should assess exposure and prioritize upgrading affected devices.

Defensive priority

Medium priority for upgrading affected devices

Recommended defensive actions

• Upgrade affected D-Link DIR-X1860Z devices to firmware version 1.0.7.260821.161908
• Verify the current firmware version of D-Link DIR-X1860Z devices
• Limit access to the ubus JSON-RPC interface
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the affected product. However, the vendor's support status for the product is unclear. The vulnerability affects D-Link DIR-X1860Z routers with firmware up to 1.0.2.220120.165402. The issue is fixed in firmware version 1.0.7.260821.161908. Defenders should verify the current firmware version of D-Link DIR-X1860Z devices and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.