D-Link has issued new firmware for the DIR-X1860Z router after researchers found that devices on the local network could reach privileged management functions without authenticating. The flaws could allow an attacker to replace the router’s administrator password and obtain Wi-Fi configuration information, including wireless credentials.

The affected device is the non-US DIR-X1860Z hardware revision A1 running firmware V1.0.2.220120.165402. D-Link disclosed the problems in advisory SAP10513 after receiving a report from researcher Lim Kar Joon. The company has not assigned CVE identifiers or published an official CVSS score, but the possible outcomes make the update important for homes and small organizations using this model.

Management interface trusted local callers too much

The weaknesses are located in the router’s OpenWrt-based ubus JSON-RPC management interface. That interface is reachable on TCP port 23355 and through the /ubus endpoint, where the routerd service handles administrative operations.

One vulnerable method, routerd.passwd_set, could reportedly be called without adequate authentication. An attacker who already has access to the same local network could use it to establish a new administrator password. The attacker could then sign in normally, obtain an authenticated ubus session and change security-sensitive settings.

Administrative control of a router can have consequences beyond losing access to its web interface. A hostile operator may alter DNS settings, weaken firewall rules, expose management services, redirect traffic or change access controls for connected devices. Router-level access also provides a useful foothold for observing or manipulating activity across a household or small-business network.

Separate calls disclosed wireless settings

A second authorization failure affected methods used to return wireless configuration. The functions identified by D-Link are routerd.wificfg_get and routerd.get_rand_key. An unauthorized local user could query them to recover configuration details, potentially including Wi-Fi passwords.

The attack is not described as remotely exploitable from anywhere on the internet by default; the adversary needs local network access. That limitation should not be mistaken for low risk. A guest, compromised laptop, malicious mobile application or infected internet-of-things device may already operate inside the network boundary. If wireless credentials are recovered, the intruder can return later or share continuing access with others.

Patched firmware and a model-name trap

D-Link corrected both problems in DIR-X1860Z firmware V1.0.7.260821.161908, finalized on August 25. Administrators should confirm the device model and hardware revision, download firmware from an official D-Link support channel and verify that the reported version—or a newer supported release—is running after installation.

The distinction between DIR-X1860Z and DIR-X1860 matters. Despite the similar names, they are different non-US products and their firmware is not interchangeable. Installing an image intended for the wrong device could cause failure or leave the router unprotected. The DIR-X1860 has also reached end of life and will no longer receive security fixes, so D-Link recommends replacing it rather than treating the X1860Z update as applicable.

• Inventory the exact router model, hardware revision and current firmware version.
• Install V1.0.7.260821.161908 or a later official DIR-X1860Z release.
• Change both administrator and Wi-Fi passwords if untrusted devices have joined the network.
• Review DNS, remote-management, forwarding and firewall settings for unexpected changes.
• Retire unsupported DIR-X1860 units and do not cross-install firmware between models.

Local networks are no longer trusted zones

The disclosure is another reminder that authentication must be enforced on every privileged management method, not only on the visible login page. Internal interfaces are routinely reachable by compromised endpoints, and an attacker can call an API directly without following the user interface’s intended workflow.

Network segmentation can reduce exposure by keeping guest and IoT devices away from router administration. Administrators should also disable remote management when it is unnecessary and restrict local management access where the product permits it. Firmware remains the essential fix, but these measures make it harder for one compromised device to become the gateway to the rest of the network.