CVE-2026-113736

critical

Description

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

https://www.dlink.com/

https://vuldb.com/vuln/422892/cti

https://vuldb.com/vuln/422892

https://vuldb.com/submit/1015789

https://vuldb.com/cve/CVE-2026-113736

https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence/blob/main/poc/poc_dhp610av_login.py

https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-106988

Details

Source: Mitre, NVD

Published: 2026-10-21

Updated: 2026-10-21

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.00921