Live › vulnerability › CVE-2026-113736
Go to dashboardAuthentication bypass in the HNAP login of the D-Link DHP-W610AV (non-US, firmware 1.02EUb03): login_prepare_hnap accepts an empty password, so a network attacker can log in with no credentials. CVSS 9.8 (v3.1) / 9.3 (v4.0). A public PoC exists; no in-the-wild exploitation known. D-Link says the model is end-of-life with no fix coming.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| DHP-W610AV | vendor | 1.02EUb03 (D-Link: all firmware versions, all hardware revisions) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-113736")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.