important · Wi-Fi routers — D-Link
A LAN client can replace an affected D-Link router's administrator password without credentials.
Affects
D-Link DIR-X1860 and DIR-X1860Z embedded Wi-Fi routers.
A client that can reach the ubus JSON-RPC service on TCP/23355 can call routerd.passwd_set without a session, choose a new administrator password and then log in normally.
Detail and 2 sources
D-Link confirms a DIR-X1860Z fix, but the evidence does not establish complete remediation across the affected deployments.