CVE-2026-4377
Use of Weak Credentials in D-Link DWR-X1820 router
- State
- Published
- Severity
- 6.0 Medium
- Published
- May 28, 2026
- Updated
- May 28, 2026
- Reserved
- Mar 18, 2026
Description
Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number.
This issue was fixed in version 1.00B16CP.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.0 Medium | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-1391 Use of Weak Credentials
Affected Products
| Product | Versions |
|---|---|
DWR-X1820D-Link Corporation |
|
References
- https://cert.pl/posts/2026/05/CVE-2026-4377third-party-advisory
- https://www.dlink.com/pl/pl/products/dwr-1820-cp#supportproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.