D-Link DIR-X1860Z Router Flaw: Unauthenticated Admin Takeover & Wi-Fi Password Leak

🚨 D-Link DIR-X1860Z: Unauthenticated Admin Takeover + Wi-Fi Credential Leak

D-Link disclosed (SAP10513) two unauthenticated flaws in the DIR-X1860Z's ubus interface (TCP 23355) letting local attackers hijack admin access and steal Wi-Fi credentials. No CVE yet, no phishing, no malware.

The Bugs

1. Admin Password Reset
routerd.passwd_set invoked without auth — any local device sets a new admin password and logs in.

2. Wi-Fi Config Disclosure
routerd.wificfg_get leaks the Wi-Fi password to unauthorized local users — no takeover required.

Quick Recon

nmap -p 23355 <router-ip>

Only run against devices you own/are authorized to test.

Why It's Interesting

• No CVE/CVSS score yet → won't hit standard vuln scanners
• Improper access control + authorization + info disclosure
• Zero brute-force noise, zero failed-login alerts — pure logic flaw
• Textbook case of why "local-only" ≠ low severity

The Fix

Patched in firmware V1.0.7.260821.161908. Don't cross-flash with the end-of-life DIR-X1860 (non-Z) — different device, no patch coming.

Hardening Checklist

• ✅ Patch immediately
• ✅ Segment IoT/guest devices on separate VLAN
• ✅ Change default admin creds
• ✅ Rotate Wi-Fi password post-patch
• ✅ Monitor traffic to port 23355

Full breakdown & detection indicators:
🔗 https://www.xpert4cyber.com/2026/08/d-link-router-flaw-wifi-password-theft.html