CVE-2026-113736
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03
- Risk score
- 76/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.9%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in the D-Link DHP-W610AV 1.02EUb03 allows an attacker to manipulate the password argument in the login_prepare_hnap function, leading to an empty password in the configuration file. This can be exploited remotely.
- Affected
- {'products': ['D-Link DHP-W610AV'], 'packages': [], 'versions': ['1.02EUb03']}
- Fix
- Check the linked advisory for a fix, as none is provided
- Exploitation
- Public proof of concept
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence
- https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence/blob/main/poc/poc_dhp610av_login.py
- https://vuldb.com/cve/CVE-2026-113736
- https://vuldb.com/submit/1015789
- https://vuldb.com/vuln/422892
- https://vuldb.com/vuln/422892/cti
- https://www.dlink.com/
Original description
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Last activity 21 Oct 2026. Patch Forecast updates every hour.