Is there a patch available for CVE-2026-4377?

Yes, a patch is available for CVE-2026-4377. Update the affected software to the latest version immediately.

D-Link DWR-X1820 CVE-2026-4377

Q: What is the CVSS score of CVE-2026-4377?

CVE-2026-4377 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32860 MEDIUM

Use of Weak Credentials (CWE-1391)

2026-05-28 cvd@cert.pl

GHSA-624f-p4gg-qwg2

Information Disclosure D-Link

6.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 28, 2026 - 12:31 EUVD

Analysis Generated

May 28, 2026 - 10:30 vuln.today

DescriptionCVE.org

Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number.

This issue was fixed in version 1.00B16CP.

AnalysisAI

Weak default credential generation in the D-Link DWR-X1820 router exposes administrative access to adjacent-network attackers who can derive the device password from its IMEI number. All devices running firmware prior to 1.00B16CP are affected when users have not changed the factory-set password - a common real-world condition for consumer-grade routers. An attacker with knowledge of the IMEI-to-password derivation algorithm and physical or logical access to the IMEI (e.g., from the device label) can authenticate to the router admin interface without prior credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected device is the D-Link DWR-X1820 LTE router (cellular CPE). The root cause is CWE-1391 (Use of Weak Credentials), specifically the practice of seeding default administrative passwords from the device IMEI - a value that is not secret, is printed on device labels, and can often be retrieved via GSM/LTE network queries or SIM-related interfaces. Because the password generation algorithm is deterministic and device-specific only in the sense that IMEI numbers are predictable in structure, an attacker who reverse-engineers or otherwise learns the algorithm can compute the password for any unmodified device solely from its IMEI. The CVSS 4.0 vector (AV:A/AC:H/AT:N/PR:N/UI:N/VC:H) reflects that exploitation requires adjacent network positioning and high attack complexity (knowledge of the algorithm), but no prior authentication. Impact is limited to confidentiality of the vulnerable component, consistent with unauthorized read access to device configuration and stored credentials.

RemediationAI

The primary remediation is upgrading device firmware to version 1.00B16CP, which is confirmed as the fix release per the CVE description. Firmware updates should be obtained from the official D-Link support page at https://www.dlink.com/pl/pl/products/dwr-1820-cp#support and applied per the device update procedure. Immediately after any firmware update - or as an interim measure before patching - administrators should change the default admin password to a strong, randomly generated credential unrelated to device hardware identifiers; this directly eliminates the exploitability of this vulnerability regardless of firmware version. As a compensating control where admin access is not needed from the LAN segment, disabling remote administration and restricting management interface access to trusted internal hosts reduces exposure, though this does not eliminate the underlying weak default credential issue. The full technical disclosure and CERT Poland advisory are available at https://cert.pl/posts/2026/05/CVE-2026-4377.