D‑Link DWR‑X1820 routers generate a weak default administrator password derived from the device’s IMEI number and do not force users to change it. Because the derivation algorithm is simple, any individual who knows the IMEI can compute the password and gain unauthorized access to the router’s web interface, potentially allowing configuration changes or network traffic manipulation.

All D‑Link DWR‑X1820 units running firmware versions earlier than 1.00B16CP are affected. The vulnerability exists on the router itself and on any services that can be managed through the default credentials.

The CVSS score of 6 indicates moderate severity. EPSS is not available and the vulnerability is not in CISA’s KEV catalog. The attack can be performed easily if an attacker can obtain the device’s IMEI or has local network access; typically the router’s management interface is only reachable from the LAN. If the router’s web interface is exposed to the internet, a remote attack is also possible. Based on the description, it is inferred that local network possession or remote exposure are the primary attack vectors, making exploitation practical for attackers in proximity or with internet reach to the device. The risk of exploitation is therefore non‑negligible for exposed or unprotected units.