Description

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 is able to address this issue. It is suggested to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-20T21:16:55.380Z",
  "pubdate": "2026-09-20T21:16:55.380Z",
  "executiveSummary": "A vulnerability has been identified in the D-Link DIR-X1860Z router, specifically within the ubus JSON-RPC interface, leading to unauthorized information disclosure.\nThe flaw stems from improper handling of specific functions within the routerd service, allowing an attacker on the local network to extract sensitive cryptographic or configuration data.\nAffected versions include up to 1.0.2.220120.165402. The vulnerability poses a significant risk as it facilitates the exposure of critical system information, potentially aiding in further unauthorized access or persistent compromise of the device.\nExploitation requires the attacker to be positioned within the local network segment to interact with the device's ubus JSON-RPC interface.\nBecause the product is no longer supported by the manufacturer, this vulnerability remains a permanent risk for legacy deployments unless mitigated through network-level security controls.",
  "technicalDetails": "The vulnerability resides within the routerd daemon of the D-Link DIR-X1860Z, specifically targeting the exposed ubus JSON-RPC interface. The affected functions, routerd.wificfg_get and routerd.get_rand_key, do not adequately sanitize inputs or restrict access, allowing for the unauthorized retrieval of sensitive configuration data.\nThe ubus (micro bus) system is an internal IPC (Inter-Process Communication) mechanism commonly used in OpenWrt-based firmware to facilitate communication between various system daemons. By exposing this interface via JSON-RPC, the router inadvertently bridges internal service communication to the network-accessible management interface.\nExploitation occurs when an attacker crafts a specific JSON-RPC request directed at the ubus interface. Because the routerd daemon fails to enforce proper authentication or authorization checks when invoking the wificfg_get or get_rand_key functions, the device executes the request and returns the requested internal state information.\nThe attack flow is characterized by the following steps: First, the attacker identifies the active ubus JSON-RPC listener on the local network. Second, the attacker formulates a malicious JSON payload targeting the vulnerable method calls. Third, the routerd daemon, lacking sufficient privilege validation, processes the request and provides the contents of the internal buffers or cryptographic keys to the requester.\nThe impact of this disclosure is severe. The ability to invoke get_rand_key allows an attacker to obtain high-entropy material used by the system for session management or encryption. Simultaneously, calling wificfg_get allows for the unauthorized retrieval of wireless configuration parameters. These disclosures significantly weaken the overall security posture of the device, effectively bypassing intended secrecy of internal configuration states.\nThis vulnerability is present in firmware versions up to 1.0.2.220120.165402. Since the vendor has ceased support for this model, the lack of patch management for these specific RPC handlers leaves the internal IPC mechanism persistently exposed to any actor with local network access."
}