B
BETTER THAN MOST
The Verdict
This is one of the better routers on the market — and it still has gaps that matter. An authentication flaw was found and patched by D-Link in a reasonable timeframe. Without router-level VPN or strict network segmentation, your work laptop, banking sessions, security cameras, and any infected smart device all share the same flat network.
A B grade is a relative ranking in a market where the floor is low. The gaps are real, they just aren’t urgent.
-
Anyone connected to your Wi-Fi can change router settings without the admin password
Anyone connected to your Wi-Fi, including guests or compromised devices, could change router settings without knowing the admin password.
Show technical detail
Authentication bypass - patched: An authentication flaw was found and patched by D-Link in a reasonable timeframe.
Everything on this network runs through this router
💻 Work laptop & remote access
🏦 Online banking & passwords
📷 Security cameras & smart locks
👧 Kids' devices & school logins
📱 Every phone & tablet at home
🔊 Smart speakers & streaming
FCC & Ban Risk
89
/100
A
Supply chain · FCC status · CVEs · Patch support
Security Capabilities
31
/100
D
Zero-Trust · VPN · Segmentation · Monitoring
FCC & Ban Risk measures supply-chain exposure, government flags, and CVE history. Security Capabilities measures what the router can actually do to protect your network. How we score →
Device context
Manufacturer
Taiwan-headquartered — D-Link Corporation, Taipei, Taiwan
Country of origin
Built in Taiwan
US gov status
FCC authorized — Not in scope
Security patches
Active
Things worth keeping in check
1
Enable auto-updates via the D-Link app
2
Change admin password from default
3
Register your product for security advisories
4
We built Rio to score 8/8 on this framework. It’s the only router we track that does — and we’d tell you if another one did
🔒
Security capabilities comparison
Here's how your router compares to Rio across the 8 dimensions we built our framework around. (Yes, we made Rio.)
D-LINK
your router
Rio Router™
full standard
Zero-Trust Device Admission
Every new device is blocked by default - admin must approve it once, even if it has the right password
Not available
Available
Network Segmentation (VLANs)
Devices on your network are isolated from each other, so a hacked smart TV can't reach your laptop
Partial
Available
Router-Level VPN for All Devices
All traffic - including smart devices that can't run VPN apps - is encrypted before leaving your home
Not available
Available
Domain Allowlisting
Block everything except approved sites; more effective than trying to blacklist billions of harmful URLs
Not available
Available
Granular Password Control
Separate passwords per network zone - changing one doesn't affect others
Partial
Available
Guest Auto-Expiry
Guest devices are automatically removed when they leave; neighbors can't reconnect without re-approval
Not available
Available
Clean Supply Chain
Manufactured outside Chinese legal jurisdiction - not subject to China's National Intelligence Law
Available
Available
Active Threat Monitoring
Real-time detection of suspicious device behavior, unusual traffic patterns, and known attack signatures on your network
Partial
Available
Rio scores 8/8 — we built it to hit every dimension on this framework. Know a router that does? Tell us and we’ll add it.
Get Rio →
See all D-Link models: D-Link brand overview →
Rio is the only router that scores 8/8. One step up from where you are.
Free US shipping · 30-day money-back · Works with any internet provider
Watch for new threats
If a new vulnerability is found for your D-Link DIR-X5460, we'll email you. One email per incident. No spam.
How this was scored · verified March 2026: This rating combines FCC authorization status, manufacturer legal jurisdiction, CVEs from NIST NVD, active patch support status, and CISA advisory mentions. See full methodology →
Reference Data
Known CVEs - D-Link brand history
From the NIST National Vulnerability Database. Your specific model may or may not be affected.
OS command injection via ping_ip parameter. Remote unauthenticated exploitation.
Remote code execution via the language parameter in getcfg.php.
See all D-Link CVEs: NIST NVD search →
Sources & evidence
All findings trace to publicly verifiable primary sources - US government databases, official FCC filings, and NIST CVE records. No proprietary or anonymous sources are used.
Full data source documentation: Scoring Methodology & Citations →