CVE-2026-4377

Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number. This issue was fixed in version 1.00B16CP.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/05/CVE-2026-4377
https://www.dlink.com/pl/pl/products/dwr-1820-cp#support

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) El router Dlink DWR-X1820 utiliza una contraseña predeterminada débil generada a partir de su número IMEI y no requiere que los usuarios la cambien. Un atacante que sabe cómo se generan las contraseñas puede descifrar fácilmente la contraseña predeterminada si tiene el número IMEI del dispositivo. Este problema se solucionó en la versión 1.00B16CP.

Information

Published : 2026-05-28 10:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-4377

Mitre link : CVE-2026-4377

CVE.ORG link : CVE-2026-4377

JSON object : View

Products Affected

No product.

CWE

CWE-1391

Use of Weak Credentials

{"id": "CVE-2026-4377", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4377", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T12:01:49.404700Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "D-Link Corporation", "product": "DWR-X1820", "versions": [{"status": "affected", "version": "1.00B14CP", "lessThan": "1.00B16CP", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-28T10:16:39.940", "references": [{"url": "https://cert.pl/posts/2026/05/CVE-2026-4377", "source": "cvd@cert.pl"}, {"url": "https://www.dlink.com/pl/pl/products/dwr-1820-cp#support", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-1391"}]}], "descriptions": [{"lang": "en", "value": "Dlink\u00a0DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number.\n\nThis issue was fixed in version\u00a01.00B16CP."}, {"lang": "es", "value": "El router Dlink DWR-X1820 utiliza una contrase\u00f1a predeterminada d\u00e9bil generada a partir de su n\u00famero IMEI y no requiere que los usuarios la cambien. Un atacante que sabe c\u00f3mo se generan las contrase\u00f1as puede descifrar f\u00e1cilmente la contrase\u00f1a predeterminada si tiene el n\u00famero IMEI del dispositivo.\n\nEste problema se solucion\u00f3 en la versi\u00f3n 1.00B16CP."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "cvd@cert.pl"}