---
id: "CVE-2026-113736"
kind: "vulnerability"
aliases: ["CVE-2026-113736"]
title: "D-Link DHP-W610AV router: HNAP login leaves password empty, remote access"
severity: "critical"
cvss: 10.0
epss: 0.00921
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "DHP-W610AV", "fixed": [], "affected": "1.02EUb03 (D-Link: all firmware versions, all hardware revisions)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["auth-bypass", "d-link", "dhp-w610av", "end-of-life", "hnap", "home-router", "infrastructure"]
not_affected_if: ["admin-interface-not-reachable", "different-firmware-version", "hnap-disabled", "not-dhp-w610av"]
published_at: "2026-10-21T01:17:25+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113736", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:53:06+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113736", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# D-Link DHP-W610AV router: HNAP login leaves password empty, remote access

Authentication bypass in the HNAP login of the D-Link DHP-W610AV (non-US, firmware 1.02EUb03): login_prepare_hnap accepts an empty password, so a network attacker can log in with no credentials. CVSS 9.8 (v3.1) / 9.3 (v4.0). A public PoC exists; no in-the-wild exploitation known. D-Link says the model is end-of-life with no fix coming.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DHP-W610AV affected 1.02EUb03 (D-Link: all firmware versions, all hardware revisions) fixed ?

## How to check

Open the router admin page and read the firmware version: 1.02EUb03 is the version named in the CVE; D-Link lists all hardware revisions and firmware as affected (EOL). Also check whether the admin/HNAP interface is reachable from the internet or untrusted LAN segments.

## Fix

No fix: D-Link lists fixed firmware as Not Available (EOL 2025-11-05) and recommends retiring and replacing the device. Until then, block admin/HNAP access from untrusted networks and the internet, and keep it off exposed networks.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113736
- 2026-10-23T22:53:06+00:00 analyst — D-Link SAP10511 (vendor): DHP-W610AV is EOL/EOS since 2025-11-05, all revisions/firmware, no fixed firmware will ship. VulDB and CVE record say a public PoC exists on GitHub (link not seen by me); no exploitation reported. Only low-value X chatter, none saved.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113736

## Documents

- [advisory] D-Link SAP10511: DHP-W610AV EOL/EOS, no fixed firmware https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10511
- [describes] VulDB VDB-422892: DHP-W610AV HNAP login empty password (PoC on GitHub) https://vuldb.com/vuln/422892
- [describes] CVE Record CVE-2026-113736 https://www.cve.org/CVERecord?id=CVE-2026-113736

## From the sources

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_