rootpwn

medium · CVSS v3 4.3 · CVSS v4 5.3

CVE-2026-94050

CVE-2026-94050 is an information disclosure vulnerability in the ubus JSON‑RPC interface of D‑Link DIR‑X1860Z routers up to firmware 1.0.2.2

Overview

CVE-2026-94050 is an information disclosure vulnerability in the ubus JSON‑RPC interface of D‑Link DIR‑X1860Z routers up to firmware 1.0.2.220120.165402. An attacker on the local network can retrieve sensitive data by manipulating routerd.wificfg_get/routerd.get_rand_key. The flaw is mitigated by upgrading to firmware 1.0.7.260821.161908.

Description

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 is able to address this issue. It is suggested to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.

Impact

Confidentiality: sensitive configuration and network data may be exposed. Availability: not directly impacted. Integrity: not directly impacted. Defenders should monitor for anomalous JSON‑RPC traffic and ensure only trusted devices can access the ubus interface.

Remediation

Upgrade the router firmware to version 1.0.7.260821.161908 or later. If upgrade is not possible, disable the ubus JSON‑RPC interface or restrict it to localhost only, and block external access to the relevant ports.

Risk context

Medium severity (CVSS v3 4.3, v4 5.3). No EPSS data available. The vulnerability is local‑network only, so risk is moderate but still requires patching to prevent data leakage.

Affected products

  • D-Link DIR-X1860Z

Scores

Severity
medium
CVSS v2
3.3
CVSS v3
4.3
CVSS v4
5.3
EPSS
—

information-disclosure local-network D-Link router ubus JSON-RPC firmware-patch

← All CVEs

Related CVEs

medium

CVE-2026-94094

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion's "streaming/size-limit" was never shipped - latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve.runtime.ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.

View analysis

medium

CVE-2026-94102

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The only sanitization is remove_xss(), an XSS keyword/entity scrubber. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-94103

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/site_pagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-94032

A SQL injection vulnerability exists in itsourcecode Leave Management System 1.0, specifically in /module/department/index.php. Attackers can manipulate the ID parameter to inject arbitrary SQL, enabling remote data exfiltration or modification. The flaw is publicly documented and can be exploited without authentication.

View analysis