This vulnerability affects D-Link DIR-X1860 and DIR-X1860Z routers up to version 1.0.2.220120.165402. It arises from improper access controls in an unspecified function of the /ubus file in the routerd component. The flaw is triggered by manipulating the passwd_set argument, allowing unauthorized actions. Exploitation requires the attacker to be on the local network. The CVSS 4.0 base score is 8.7, indicating high severity. Public exploit code has been released, but there is no information about active exploitation in the wild or available patches.

An attacker on the local network can exploit this vulnerability to bypass access controls related to the passwd_set argument in the routerd component, potentially leading to unauthorized configuration changes or privilege escalation. The exact impact is not detailed beyond the improper access control condition. The availability of public exploit code increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local network access to trusted users only and monitor for suspicious activity related to router management. No official patch or workaround information is provided in the available data.