TI-2026-03812 Aliases CVE-2026-4377 GHSA-624f-p4gg-qwg2

Use of Weak Credentials in D-Link DWR-X1820 router

LOW 26CWE-1391Published 2026-05-28 · Updated 2026-05-28

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number. This issue was fixed in version 1.00B16CP.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00141 3rd percentileScored 2026-11-07

Fix Fixed DWR-X1820 (D-Link Corporation): 1.00B16CP

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
D-Link	DWR-X1820	1.00B14CP to before 1.00B16CP	1.00B16CP	Patch available	CNA

DWR-X1820 VendorD-Link Affected 1.00B14CP to before 1.00B16CP Fixed in 1.00B16CP Patch available CNA

Remediation

Fix · CNA DWR-X1820 (D-Link Corporation) Fixed in 1.00B16CP

Timeline

2026-10-02 Threatist record created from CVE-2026-4377
2026-10-03 Alias added: GHSA-624f-p4gg-qwg2

References

Advisory 1

https://cert.pl/posts/2026/05/CVE-2026-4377

Other 1

https://www.dlink.com/pl/pl/products/dwr-1820-cp#support

TI-2024-03070 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection KEVCVSS 3.1CRITICAL 9.8
TI-2024-03069 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials KEVCVSS 3.1CRITICAL 9.8
TI-2024-00708 D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal KEVCVSS 3.1CRITICAL 9.8
TI-2023-10693 OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to… KEVCVSS 3.1CRITICAL 9.8
TI-2022-17249 D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
TI-2022-09657 D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE)… KEVCVSS 3.1CRITICAL 9.8

See all 979 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences