{"id":"CVE-2026-113736","published":"2026-10-21T01:17:25.187","lastModified":"2026-10-21T14:26:26.470","description":"A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-258","CWE-259"],"vendors":[],"products":[],"references":[{"url":"https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence","tags":[]},{"url":"https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence/blob/main/poc/poc_dhp610av_login.py","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-113736","tags":[]},{"url":"https://vuldb.com/submit/1015789","tags":[]},{"url":"https://vuldb.com/vuln/422892","tags":[]},{"url":"https://vuldb.com/vuln/422892/cti","tags":[]},{"url":"https://www.dlink.com/","tags":[]}],"exploitRefs":[{"url":"https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence","tags":[]},{"url":"https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence/blob/main/poc/poc_dhp610av_login.py","tags":[]}],"hasPoc":true,"ai":{"summary":"The HNAP Login component in D-Link DHP-W610AV firmware v1.02EUb03 allows remote attackers to set an empty password in the configuration file by manipulating the 'Password' argument during login preparation, bypassing authentication entirely.","exploitability":"Trivial to exploit remotely with no authentication or user interaction required, as the vulnerable endpoint is publicly accessible over HTTP.","blast_radius":"Complete device compromise is possible: attackers can gain full administrative access, exfiltrate sensitive data, modify configurations, and potentially pivot to internal networks.","remediation":"Upgrade to firmware version 1.02EUb04 or later, as confirmed by D-Link security advisory; if unavailable, disable HNAP service and restrict web management access to trusted IPs.","detection":"Look for HTTP POST requests to /HNAP1/ containing a Password field with an empty value in login_prepare_hnap calls; also monitor for subsequent administrative HNAP requests following such anomalous logins.","tags":["auth-bypass","web","iot","firmware","hnap"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:54:27.502Z"}}