D-Link Router Flaws Let Local Attackers Reset Admin Passwords and Steal Wi-Fi Credentials

• The Mess: D-Link patched two access-control flaws in the DIR-X1860Z that allow an unauthenticated attacker on the local network to change the router’s administrator password and recover Wi-Fi configuration data.
• The Damage: Once administrative access is obtained, an attacker can control DNS, firewall and port-forwarding settings — while stolen Wi-Fi credentials can provide persistent access to the network.
• The Fix: Update the affected DIR-X1860Z to firmware V1.0.7.260821.161908 or later and verify that the device is actually the DIR-X1860Z, not the similarly named DIR-X1860.

Your router has one job.

Keep strangers out.

D-Link’s DIR-X1860Z managed to make that considerably harder.

Two newly disclosed flaws in the router’s OpenWrt-based management interface can let an attacker on the same local network bypass authentication, replace the administrator password and retrieve wireless configuration information.

And the attacker doesn’t need to know the old password.

The Password Can Be Replaced

The main problem sits in the router’s ubus JSON-RPC interface.

Specifically, researchers identified the privileged routerd.passwd_set method.

It is supposed to require administrative authorization.

Instead, an attacker with local-network access can invoke it without properly authenticating first.

The attacker sets a new administrator password.

Then they simply log in normally.

At that point, the router believes the attacker is the administrator.

No password cracking.

No brute force.

No stolen admin credentials.

Just a broken authorization check.

The Router Becomes the Attacker’s Playground

Administrative access to a router is not a minor privilege.

The attacker can potentially modify:

• DNS settings
• firewall rules
• port forwarding
• wireless configuration
• other network settings

That can turn a compromised router into a launch point for attacks against devices behind it.

DNS manipulation is particularly nasty.

A compromised DNS configuration can redirect users toward attacker-controlled infrastructure while everything on the local network continues to look normal.

Wi-Fi Credentials Can Also Leak

The second flaw makes the situation worse.

Additional routerd functionality can expose wireless configuration information, including Wi-Fi credentials.

That means an attacker doesn’t necessarily lose access when the legitimate owner discovers the changed administrator password.

They may already have the Wi-Fi password.

The router can effectively hand them another way back in.

Local Network Doesn’t Mean Safe

There is an important limitation.

This isn’t presented as an unrestricted Internet-facing exploit.

The attacker needs access to the same local network.

But that’s a much weaker security boundary than it sounds.

A compromised laptop can provide that access.

So can an untrusted wireless client.

A malicious guest.

A compromised IoT device.

Or someone who gains physical access to an Ethernet connection.

Once an attacker is inside the LAN, the router’s management interface becomes part of the attack surface.

The Vulnerable Configuration

The reported issues affect the DIR-X1860Z hardware revision A1/V1.0 running firmware:

V1.0.2.220120.165402

D-Link has released:

V1.0.7.260821.161908

or a later applicable firmware version.

There is another important detail.

The DIR-X1860Z and DIR-X1860 are different products.

D-Link specifically warns users not to install firmware intended for one model on the other.

No CVE. Still Dangerous.

At publication time, the issues did not have CVE identifiers or an authoritative CVSS score assigned.

That doesn’t make the bugs less interesting.

An unauthenticated password change on a network appliance is already a serious security problem.

Especially when it can be followed by administrative control and exposure of Wi-Fi credentials.

The absence of a CVE number doesn’t make the router magically safer.

The Older DIR-X1860 Is a Separate Problem

D-Link has also marked the regular DIR-X1860 as end-of-life/end-of-service across its hardware revisions.

That means owners shouldn’t assume another security update is coming for that model.

If the device is unsupported, replacement is the sensible option.

A router that no longer receives security patches is eventually going to become the weakest device on the network.

What Administrators Should Check

After updating, don’t just close the browser and move on.

Check whether:

• the administrator password changed unexpectedly
• DNS servers were modified
• unknown port-forwarding rules appeared
• firewall settings changed
• wireless credentials were altered
• unfamiliar devices joined the network
• router configuration timestamps look suspicious

If compromise is suspected, reset the administrator credentials and Wi-Fi credentials rather than assuming the firmware update alone cleans up the incident.

Bugstoday Opinion

This is exactly why “the attacker needs to be on the LAN” isn’t a comforting sentence anymore.

A router doesn’t know whether the laptop beside it is clean.

It doesn’t know whether the Wi-Fi client is trustworthy.

It simply sees a device that can reach the management interface.

And if that interface allows an unauthenticated user to replace the administrator password, the attacker doesn’t need to break into the router.

The router lets them in.

Bugstoday verdict: local-network access is not a security excuse. Patch the DIR-X1860Z, rotate the Wi-Fi credentials and check the router configuration. If you’re still running the unsupported DIR-X1860, it’s time for a replacement.

Today’s Bugs. Tomorrow’s Breaches.