CVE-2026-113736 is a critical (CVSS 3.1: 9.8) flaw in D-Link DHP-W610AV firmware 1.02EUb03 that leaves an empty password in the HNAP Login configuration, and a public proof-of-concept exploit is available.
What Is It
The flaw is in the login_prepare_hnap function, which the record links to the file etc/defnodes/defaultvalue.xml in the device's HNAP Login component. Manipulating the Password argument results in an empty password in the configuration file. The CNA (VulDB) classifies the weakness as CWE-258 (Empty Password in Configuration File) and CWE-259 (Use of Hard-coded Password).
The record says the attack can be launched remotely and that the exploit has been disclosed publicly. The references include a proof-of-concept login script (poc_dhp610av_login.py) hosted on GitHub.
Why It Matters
The scores reflect a flaw that is easy to exploit over the network:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is network-reachable, needs low attack complexity, and requires no privileges or user interaction. Impact on confidentiality, integrity and availability is high. - CVSS 4.0: 8.9 HIGH, with exploit maturity rated as Proof-of-Concept.
- CVSS 2.0: 10.0, with complete C/I/A impact.
There is no CISA Known Exploited Vulnerabilities (KEV) entry for this CVE in the source data, so KEV does not confirm active exploitation in the wild. However, a public PoC means the barrier to exploitation is low.
What's Vulnerable
- Vendor: D-Link
- Product: DHP-W610AV
- Affected version: 1.02EUb03
- Component: HNAP Login
- CPE:
cpe:2.3:h:d-link:dhp-w610av:*:*:*:*:*:*:*:*
The supplied data lists no other firmware versions as affected or unaffected.
Patch Status
The supplied sources contain no vendor advisory, fixed firmware version or remediation guidance. There is also no CISA KEV required action or due date, because the KEV entry is empty. The NVD record is in "Received" status and has not yet been analyzed by NVD. Owners of the affected device should check D-Link's site for vendor guidance.