{"id":"CVE-2026-113736","kind":"vulnerability","aliases":["CVE-2026-113736"],"related":[],"title":"D-Link DHP-W610AV router: HNAP login leaves password empty, remote access","description":"A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","summary":"Authentication bypass in the HNAP login of the D-Link DHP-W610AV (non-US, firmware 1.02EUb03): login_prepare_hnap accepts an empty password, so a network attacker can log in with no credentials. CVSS 9.8 (v3.1) / 9.3 (v4.0). A public PoC exists; no in-the-wild exploitation known. D-Link says the model is end-of-life with no fix coming.","severity":"critical","cvss":10.0,"epss":0.00921,"exploited":false,"exploited_at":null,"products":[{"name":"DHP-W610AV","fixed":[],"affected":"1.02EUb03 (D-Link: all firmware versions, all hardware revisions)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["auth-bypass","d-link","dhp-w610av","end-of-life","hnap","home-router","infrastructure"],"not_affected_if":["admin-interface-not-reachable","different-firmware-version","hnap-disabled","not-dhp-w610av"],"how_to_check":"Open the router admin page and read the firmware version: 1.02EUb03 is the version named in the CVE; D-Link lists all hardware revisions and firmware as affected (EOL). Also check whether the admin/HNAP interface is reachable from the internet or untrusted LAN segments.","fix":"No fix: D-Link lists fixed firmware as Not Available (EOL 2025-11-05) and recommends retiring and replacing the device. Until then, block admin/HNAP access from untrusted networks and the internet, and keep it off exposed networks.","status":"open","published_at":"2026-10-21T01:17:25+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:31+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:33:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown\nRestrict router admin access to trusted networks until D-Link publishes a fixed firmware.","reach":"internet","title":"D-Link DHP-W610AV router: HNAP login leaves password empty, remote access","impact":"high","summary":"A flaw in the HNAP login component of the D-Link DHP-W610AV 1.02EUb03 router sets the password in its configuration file to empty. The exploit is public, so an attacker on the network may log in to the router without a valid password.","category":"infrastructure","who_cares":["d-link","dhp-w610av","home-router","hnap"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker logs into the router with an empty password and changes its settings.","analyst_note":"Check the NVD entry and D-Link's advisories for a fixed firmware version and whether HNAP is enabled by default.","how_to_check":"Check the firmware version on the router admin page: 1.02EUb03 is affected.\nunknown","needs_analyst":true,"not_affected_if":["different-firmware-version","hnap-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000503,"input_tokens":2959,"output_tokens":414,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give only the NVD entry; confirm the vendor advisory or a D-Link fixed firmware version and whether the device is end-of-life.","search":"'-113736':17A,20A '-2026':16A,19A '1.02':60B,122C '9.3':82B '9.8':80B 'accept':65B 'access':14A 'argument':146C 'attack':72B,156C 'auth':25B 'auth-bypass':24B 'authent':42B 'bypass':26B,43B 'come':109B 'compon':139C 'configur':153C 'credenti':78B 'cve':15A,18A 'cvss':79B 'd':2A,28B,51B,96B,117C 'd-link':1A,27B,50B,95B,116C 'dhp':5A,22A,31B,54B,120C 'dhp-w610av':4A,21A,30B,53B,119C 'disclos':165C 'element':126C 'empti':12A,67B,150C 'end':34B,103B 'end-of-lif':33B,102B 'etc/defnodes/defaultvalue.xml':136C 'eub03':61B,123C 'exist':87B 'exploit':93B,162C 'file':135C,154C 'firmwar':59B 'fix':108B 'found':114C 'function':129C 'hnap':8A,37B,46B,64B,132C,140C 'home':39B 'home-rout':38B 'impact':125C 'in-the-wild':89B 'infrastructur':41B 'initi':159C 'known':94B 'lead':148C 'leav':10A 'life':36B,105B 'link':3A,29B,52B,97B,118C 'log':74B 'login':9A,47B,62B,130C,141C 'manipul':143C 'may':170C 'model':100B 'network':71B 'non':57B 'non-us':56B 'password':11A,68B,147C,151C 'poc':86B 'prepar':63B,131C 'public':85B,168C 'remot':13A,160C 'router':7A,40B 'say':98B 'us':58B 'use':172C 'v3.1':81B 'v4.0':83B 'vulner':111C 'w610av':6A,23A,32B,55B,121C 'wild':92B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113736","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113736","severity":null,"published_at":"2026-10-21T01:17:25+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113736:318","url":null,"severity":null,"published_at":"2026-10-23T22:53:06+00:00","modified_at":"2026-10-23T22:53:06+00:00","first_seen_at":"2026-10-23T22:53:06+00:00","fetched_at":"2026-10-23T22:53:06+00:00","note":"D-Link SAP10511 (vendor): DHP-W610AV is EOL/EOS since 2025-11-05, all revisions/firmware, no fixed firmware will ship. VulDB and CVE record say a public PoC exists on GitHub (link not seen by me); no exploitation reported. Only low-value X chatter, none saved."},{"source":"epss","external_id":"CVE-2026-113736","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113736","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":1642,"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10511","title":"D-Link SAP10511: DHP-W610AV EOL/EOS, no fixed firmware","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1643,"url":"https://vuldb.com/vuln/422892","title":"VulDB VDB-422892: DHP-W610AV HNAP login empty password (PoC on GitHub)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1644,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113736","title":"CVE Record CVE-2026-113736","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}