Vulnerability Report

CVE-2026-94036

Title: Improper Access Controls in D-Link DIR-X1860/Z

Other

Proof Of Concept

PoC Available for CVE-2026-94036

CWE Category CWE-266

Published Date Sep 20, 2026

Modified Date Sep 21, 2026

Exploit Status Available

Score 7.4 CVSS v4.0

Exploit Probability (EPSS)

0.56%

Vulnerability Summary

CVE-2026-94036: A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

Impacted Vendors

Analysis in Progress...

Reference Links

https://pastebin.com/gzKNCCPV https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10513 https://vuldb.com/cve/CVE-2026-94036 https://vuldb.com/submit/947565 https://vuldb.com/vuln/407965 https://vuldb.com/vuln/407965/cti https://www.dlink.com/

CVSS v4.0

Source Entity [email protected]

Severity HIGH

7.4

Attack Vector

ADJACENT

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity HIGH

8.8

Attack Vector

ADJACENT_NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity HIGH

8.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:A/AC:L/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-94036 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/djzzlim/CVE-2026-94036

View Code

September 21, 2026 MODIFIED

Vulnerability data updated via NVD.

September 21, 2026 MODIFIED

Vulnerability data updated via NVD.

September 20, 2026 MODIFIED

Vulnerability data updated via NVD.

September 20, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector ADJACENT

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Stack

No specific products linked.