Is there a patch available for CVE-2026-94050?

Yes, a patch is available for CVE-2026-94050. Update the affected software to the latest version immediately.

D-Link DIR-X1860Z CVE-2026-94050

Q: What is the CVSS score of CVE-2026-94050?

CVE-2026-94050 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-83787 MEDIUM

Information Exposure (CWE-200)

2026-09-20 VulDB

GHSA-p6p3-fj5h-8g7w

Information Disclosure D-Link D-Link Dir X1860Z

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Adjacent-network unauthenticated call to an exposed ubus function (AV:A/PR:N/UI:N/AC:L); impact is limited information disclosure only, so C:L with I:N/A:N.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 20, 2026 - 20:46 vuln.today

DescriptionCVE.org

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 is able to address this issue. It is suggested to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Information disclosure in D-Link DIR-X1860Z routers running firmware up to 1.0.2.220120.165402 lets unauthenticated users on the same local network segment read sensitive data through two ubus JSON-RPC handlers, routerd.wificfg_get and routerd.get_rand_key. The bug is reachable only from the adjacent network (LAN, guest WiFi, or a compromised local device) and carries low confidentiality impact with no integrity or availability effect, and no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the attacker to be positioned on the same local network segment as the router (AV:A adjacent - not routable from the internet), reachable via LAN, guest WiFi, or a compromised local device. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a low-to-moderate real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: 1.0.7.260821.161908 - apply the DIR-X1860Z Rev.A firmware HOTFIX from https://support.dlink.com/resource/SECURITY_ADVISEMENTS/DIR-X1860Z/DIR-X1860Z_REVA_FIRMWARE_V1.0.7.260821.161908_HOTFIX.zip and confirm the updated version string in the router UI, following the guidance in D-Link advisory SAP10513. … Detailed patch versions, workarounds, and compensating controls in full report.