D-Link DIR-X1860Z Flaws Expose Router Administration and Wi-Fi Credentials

Description

Security weaknesses have been identified in the D-Link DIR-X1860Z router's OpenWrt-based ubus JSON-RPC management interface. The affected firmware allows certain privileged routerd methods to be accessed without proper authentication.

The primary issue involves routerd.passwd_set, which could allow an unauthenticated user with local network access to change the administrator password and subsequently obtain an authenticated administrative session. A related weakness can expose wireless configuration information, including Wi-Fi credentials.

D-Link has resolved the reported issues in firmware V1.0.7.260821.161908. No CVE identifier, CWE assignment, or authoritative CVSS score has been assigned to these findings.

Technical Description

The affected component is the ubus JSON-RPC / routerd management interface, exposed through TCP port 23355 at the /ubus endpoint.

The reported issues affect DIR-X1860Z hardware A1 / V1.0 running firmware V1.0.2.220120.165402. The vulnerabilities are categorized by D-Link as improper access control, improper authorization, and information disclosure.

The principal affected methods include:

• routerd.passwd_set
• routerd.wificfg_get
• routerd.get_rand_key

Attack Overview

An attacker who has access to the local network could interact with the router's management interface without valid authentication.

The potential attack path is:

Local Network Access → Unauthenticated ubus Request → Administrator Password Modification → Administrative Session

A separate path involves unauthorized access to wireless configuration methods:

Local Network Access → Wireless Configuration Methods → Wi-Fi Credential Disclosure

The combination of these weaknesses could provide an attacker with increased control over the network device and potentially enable continued access to the associated wireless network.

Technical Analysis

1. Unauthenticated Administrator Password Modification

The routerd.passwd_set method could reportedly be invoked without proper authentication through the ubus JSON-RPC management interface.

An unauthenticated user with local network access could potentially establish a new administrator password. The attacker could then use the normal authentication process to obtain an authenticated administrative ubus_rpc_session.

2. Wireless Configuration Disclosure

The second finding involves unauthorized access to wireless configuration information through exposed routerd methods.

D-Link's advisory identifies interaction between routerd.wificfg_get and routerd.get_rand_key that could allow recovery of wireless configuration information, including wireless credentials, on the affected firmware.

3. Management Interface Risk

Because the affected functionality belongs to the router's privileged management interface, successful exploitation could give an attacker greater control over network configuration and increase the risk of attacks against other systems connected to the same network.

Potential Impact

Potential consequences include:

• Administrator account compromise
• Unauthorized router configuration changes
• Wi-Fi credential exposure
• Unauthorized network access
• Increased risk to connected devices
• Network configuration manipulation
• Potential follow-on attacks from a compromised network position

Recommendations

Immediate Actions

1. Upgrade affected DIR-X1860Z devices to firmware V1.0.7.260821.161908 or later.
2. Verify the router model and hardware revision before applying firmware.
3. Change the administrator password after remediation.
4. Change Wi-Fi credentials if exposure is suspected.
5. Review router settings for unauthorized modifications.
6. Review connected-device lists for unknown systems.
7. Monitor administrative activity for suspicious changes.

Preventive Actions

1. Restrict access to router-management interfaces to trusted networks.
2. Avoid unnecessary exposure of management services.
3. Segment network infrastructure from general user systems.
4. Maintain an inventory of router models and firmware versions.
5. Regularly monitor vendor security advisories.
6. Use strong and unique administrator and Wi-Fi passwords.
7. Replace unsupported network equipment.
8. For the DIR-X1860, which has reached End of Life / End of Service, replace the device with a currently supported product.

Conclusion

The D-Link DIR-X1860Z weaknesses demonstrate the risks created when privileged network-management functions can be accessed without adequate authentication. Although exploitation requires local network access, the ability to modify the administrator password and potentially recover wireless credentials could significantly increase an attacker's control over the affected network.

Organizations and users operating the affected DIR-X1860Z firmware should prioritize upgrading to V1.0.7.260821.161908 or later, validate router configurations after remediation, and review credentials if unauthorized access is suspected.