CVE-2026-113736: Empty Password in Configuration File in D-Link DHP-W610AV
Description
CVE-2026-113736 is a critical vulnerability in the D-Link DHP-W610AV device version 1.02EUb03. It involves the login_prepare_hnap function in the HNAP Login component, where manipulation of the Password argument results in an empty password being written to the configuration file. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed, increasing the risk of exploitation.
CVSS v4.0
Score 9.3critical
Affected software
D-Link
DHP-W610AV
cpe:2.3:h:d-link:dhp-w610av:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-113736 affects D-Link DHP-W610AV version 1.02EUb03. It arises from improper handling of the Password argument in the login_prepare_hnap function within the etc/defnodes/defaultvalue.xml file of the HNAP Login component. This flaw allows an attacker to cause an empty password to be set in the device's configuration file remotely, potentially bypassing authentication controls. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. Public exploit code is available, but no known active exploitation in the wild has been reported.
Potential Impact
An attacker can remotely manipulate the device's configuration to set an empty password, effectively bypassing authentication and gaining unauthorized access. This compromises the device's security, potentially allowing full control over the affected device.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict remote access to the device and monitor for suspicious activity related to HNAP login attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-20T16:14:12.698Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad80bff2cdf04f6568caa0d
Added to database: 10/21/2026, 00:49:03 UTC
Last enriched: 10/21/2026, 01:48:15 UTC
Last updated: 10/21/2026, 02:48:20 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.