CVE-2021-41445
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability exists in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta. A remote unauthenticated attacker can execute code on the victim's device by sending a crafted URL to the victim.
Risk Assessment
The risk includes potential session hijacking, credential theft, or malicious actions within the router's management interface context.
Recommendation
Immediately update the D-Link DIR-X1860 firmware to version v1.10WWB09_Beta or later. Until updated, avoid clicking suspicious links and restrict access to the administrative interface.
Other vulnerabilities in D-Link DIR-X1860
See all- CVE-2026-94036High
A security flaw was discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402 in an unknown function of /ubus in the routerd component. Manipulation of the passwd_set argument results in improper access controls, and the attack must originate from the local network. The exploit has been released to the public and may be used for attacks.
- CVE-2021-41442High
An HTTP smuggling vulnerability in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to perform a DoS attack by sending a specially crafted HTTP packet.
- CVE-2021-41441High
A DoS vulnerability in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to reboot the router by sending a specially crafted URL to an authenticated victim. The victim must visit this URL for the router to reboot.
Original NVD description (English source)
A reflected cross-site-scripting attack in web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to execute code in the device of the victim via sending a specific URL to the unauthenticated victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS