CVE-2026-94036

Executive Summary

CVE-2026-94036 is an improper access control vulnerability (CWE-266) affecting D-Link DIR-X1860 and DIR-X1860Z routers running firmware versions up to 1.0.2.220120.165402. The flaw resides in the /ubus interface managed by the routerd component, where manipulation of the passwd_set argument allows an unauthenticated attacker on the local network to bypass authorization controls and modify the device administrator password. With a CVSS 3.1 base score of 8.8 (High), and a publicly available exploit, affected devices face full compromise of confidentiality, integrity, and availability if an adversary gains adjacent network access.

Technical Analysis

The vulnerability is classified as CWE-266: Incorrect Privilege Assignment. The NVD description explicitly states that the impacted element is an unknown function of the file /ubus within the routerd component, and that manipulation of the passwd_set argument results in improper access controls. The /ubus endpoint is part of the OpenWrt UBUS (micro bus) inter-process communication system, which is used by routerd — a common D-Link daemon managing router configuration and system events. The passwd_set argument strongly suggests an administrative function intended to set the system password (e.g., for the root or admin account).

Because the vulnerability is an improper access control, the attack mechanism likely involves sending a crafted request to the /ubus service (either via HTTP or JSON-RPC) that invokes the password-setting function without requiring prior authentication or a valid session token. The CVSS vector indicates that no privileges are required (PR:N) and no user interaction is needed (UI:N), meaning the attacker can directly trigger the vulnerable function. The attack vector is adjacent (AV:A), meaning the adversary must be on the same local network segment (e.g., connected to the router's LAN or Wi-Fi, or on a bridged network).

The impact to confidentiality, integrity, and availability is high (C:H/I:H/A:H). Password modification allows the attacker to gain persistent administrative access to the router, enabling configuration changes, traffic interception, or further lateral movement. The exact implementation details of the passwd_set function are not provided in the NVD description; therefore, specific function names, JSON-RPC method names, or session token handling cannot be confirmed. However, the vulnerability class points to a missing authorization check in the UBUS access control layer.

Exploitation Scenarios

The following attack chain is inferred strictly from the NVD description and the vulnerability class (CWE-266). No public PoC details are available beyond the statement that an exploit has been released.

1. Reconnaissance / Target Identification: The attacker must first gain access to the local network of the D-Link DIR-X1860 or DIR-X1860Z router. This can be achieved via Wi-Fi cracking, physical LAN access, or by compromising another device on the same network. The attacker scans for the router's management interface. The /ubus endpoint is typically exposed on the LAN side (often via HTTP on port 80 or 443). Using Shodan-like dorks, the attacker can also identify Internet-exposed routers, but the CVSS vector AV:A limits the primary attack to adjacent networks.

2. Triggering the Flaw: The attacker sends a crafted request to the /ubus interface. The request must invoke a function (unnamed in the advisory) that handles the passwd_set argument. Because of improper access controls, the attacker does not need to authenticate or provide a valid session token. The request likely contains a new password value for the administrator account. The routerd component processes this request without verifying that the caller has the necessary privileges.

3. Payload / Execution Method: At the vulnerability-class level, the attacker sends a network packet containing a JSON or form-encoded payload with the passwd_set parameter set to a password of their choosing. The exact protocol (HTTP POST, JSON-RPC, or raw UBUS message) is not specified in the NVD description. The attacker may need to include other parameters to satisfy the function's signature, but the advisory does not provide these details. The attack is likely a single unauthenticated request.

4. Post-Exploitation Impact: Upon successful exploitation, the administrator password is changed to a value known by the attacker. The attacker can then log in to the router's web interface or SSH with full administrative privileges. This allows them to modify DNS settings (DNS hijacking), enable remote management, install persistent backdoors, intercept or redirect traffic, and use the router as a pivot point for further network attacks. The high availability impact indicates the attacker could also disrupt network services or brick the device.

Note: No public PoC code or specific exploit details are available in the provided intelligence. The attack chain is described at the vulnerability-class level to avoid fabricating implementation specifics.

Impact Assessment

The business impact is severe for organizations and home users relying on D-Link DIR-X1860 and DIR-X1860Z routers. With a CVSS base score of 8.8, the vulnerability allows an unauthenticated attacker on the local network to fully compromise the device. The confidentiality impact is high because the attacker can read all traffic passing through the router, including sensitive credentials and internal communications. The integrity impact is high because the attacker can alter routing rules, DNS responses, and firmware. The availability impact is high because the attacker can disable the device or cause denial of service.

The blast radius includes all devices behind the affected router. Once the router is compromised, the attacker can conduct man-in-the-middle attacks, redirect users to malicious sites, or move laterally into the internal network. The EPSS score is not yet available, but the presence of a public exploit increases the likelihood of active exploitation. CISA KEV does not currently list this CVE, but the public exploit and unpatched status make it a high-priority target. Affected systems are limited to the specific D-Link models and firmware versions up to 1.0.2.220120.165402. No patch is available.

Detection Guidance

Sigma Rule

This rule detects attempts to exploit the /ubus endpoint with the passwd_set argument in HTTP requests. It is designed for web server or proxy logs. Since the exact URL path may vary, the rule focuses on the combination of /ubus and passwd_set.

title: D-Link DIR-X1860 UBUS Password Set Exploitation Attempt
id: 9f8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the /ubus endpoint with the passwd_set parameter, indicating an attempt to exploit CVE-2026-94036.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-94036
author: Valters IT Threat Intelligence
date: 2026-05-12
tags:
    - attack.t1190
    - cve.2026.94036
logsource:
    category: webserver
    product: dlink
detection:
    selection:
        cs-uri-stem|contains: '/ubus'
        cs-uri-query|contains: 'passwd_set'
    condition: selection
falsepositives:
    - Legitimate administrative password changes via the web interface (rare, as this endpoint is typically not user-facing)
level: high

YARA Rule

This YARA rule detects the presence of the vulnerable routerd binary or firmware images containing the passwd_set string and UBUS references. It is intended for file scanning on affected devices or firmware analysis.

rule CVE_2026_94036_DLink_DIR_X1860_UBUS
{
    meta:
        description = "Detects D-Link DIR-X1860 firmware with vulnerable routerd UBUS passwd_set function"
        author = "Valters IT Threat Intelligence"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94036"
        hash = "unknown"
    strings:
        $s1 = "passwd_set" ascii wide
        $s2 = "/ubus" ascii wide
        $s3 = "routerd" ascii wide
    condition:
        all of them
}

Suricata IDS Rule

This Suricata rule detects HTTP requests to /ubus containing passwd_set in the URI or body. It uses the http.uri and http.request_body buffers.

alert http any any -> any any (msg:"CVE-2026-94036 D-Link DIR-X1860 UBUS Password Set Exploitation Attempt"; flow:to_server,established; http.uri; content:"/ubus"; http.uri; content:"passwd_set"; http.request_body; content:"passwd_set"; classtype:attempted-admin; sid:10000001; rev:1; reference:cve,2026-94036;)

Elastic Detection

This EQL rule detects HTTP requests to the /ubus endpoint with passwd_set from network logs or web server logs.

network where
  http.request.method == "POST" and
  http.request.uri : "/ubus" and
  http.request.body : "passwd_set"

Splunk SPL Query

This Splunk query searches web server or proxy logs for requests containing both /ubus and passwd_set.

index=web OR index=proxy
| search (uri="*/ubus*" OR url="*/ubus*") AND (uri="*passwd_set*" OR url="*passwd_set*" OR body="*passwd_set*")
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip, uri, url, status
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

This Wazuh rule detects HTTP requests to /ubus with passwd_set in the URI or body. It assumes web server logs are ingested.

<group name="dlink_cve_2026_94036,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/ubus</field>
    <field name="url">passwd_set</field>
    <description>CVE-2026-94036: D-Link DIR-X1860 UBUS password set exploitation attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Isolate affected D-Link DIR-X1860 and DIR-X1860Z routers on a dedicated VLAN or network segment that is not accessible by untrusted users.
   • Disable remote management and UPnP if not required.
   • Restrict local network access to the router's management interface to only trusted administrative hosts via firewall rules.
   • Monitor for suspicious password changes via router logs and consider periodic password rotations.
   • If no patch is available, consider replacing the device with a supported model or using an alternative router.

2. Patch/Upgrade Steps:

   • No patch is currently available. Monitor D-Link's security advisory page for firmware updates. Once a patched firmware version is released, upgrade immediately.
   • Check D-Link's official support site for the DIR-X1860 and DIR-X1860Z models for any firmware updates beyond 1.0.2.220120.165402.

3. Long-Term Hardening:

   • Implement network segmentation to prevent lateral movement from compromised devices.
   • Use strong, unique administrative passwords and enable two-factor authentication where supported.
   • Regularly audit router configurations and monitor for unauthorized changes.
   • Consider deploying a network-based IDS/IPS to detect exploitation attempts on the local network.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94036
• D-Link Security Advisories: https://www.dlink.com/en/security-bulletin
• CWE-266: Incorrect Privilege Assignment: https://cwe.mitre.org/data/definitions/266.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• OpenWrt UBUS Documentation: https://openwrt.org/docs/techref/ubus (for context on the /ubus interface)

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence is available in the provided intelligence. The public exploit increases the risk of opportunistic attacks, but no specific campaigns have been identified.