Vulnerability · Published May 28, 2026 · Assigned by CERT-PL
CVE-2026-4377Use of Weak Credentials in D-Link DWR-X1820 router
Medium 6.0
In plain English
A medium-severity security flaw in DWR-X1820 from D-Link Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.1%top 96.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number. This issue was fixed in version 1.00B16CP.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| D-Link Corporation | DWR-X1820 | 1.00B14CP – before 1.00B16CP |
Weakness: CWE-1391 · Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://cert.pl/posts/2026/05/CVE-2026-4377 third-party-advisory
- https://www.dlink.com/pl/pl/products/dwr-1820-cp#support product