CVE-2026-113736

Deferred Deferred - Pending Action

Authentication Bypass via Empty Password in D-Link DHP-W610AV

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulDB

Description

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113736

EUVD

EUVD-2026-106988

Affected Vendors & Products

Vendor	Product	Version / Range
D-Link	DHP-W610AV	1.02EUb03

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-258	Using an empty string as a password is insecure.
CWE-259	The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

Executive Summary

This vulnerability affects the D-Link DHP-W610AV device running firmware version 1.02EUb03. It allows an unauthenticated attacker to gain administrative access to the device's HTTP management interface by exploiting an empty password for the default Admin account. The issue occurs because the device's initialization script sets an empty password when certain conditions are met, such as missing device-data password or a sentinel value being used. The HTTP management service starts automatically and accepts an empty password, granting full administrative privileges.

Detection Guidance

Check if the D-Link DHP-W610AV device is running firmware version 1.02EUb03. Attempt to log in with an empty password for the 'Admin' account. If login succeeds, the device is vulnerable. Use network scanning tools to identify devices with open HTTP management interfaces on port 80 or 443.

Impact Analysis

An attacker could exploit this vulnerability to gain full control over the D-Link DHP-W610AV device remotely. This includes accessing sensitive settings, modifying network configurations, intercepting traffic, or using the device as a pivot point for further attacks within the network. Since the device is a router, compromise could affect all connected devices.

Compliance Impact

This vulnerability allows unauthorized remote access to the device's administrative interface due to an empty password, which could lead to unauthorized data access or modification. For GDPR, this may violate requirements for secure access controls and data protection. For HIPAA, it could compromise protected health information if the device is used in healthcare environments.

Mitigation Strategies

Update the device firmware to the latest version if available. Disable remote management access if not required. Change the default 'Admin' password to a strong, unique value. Block external access to the device's HTTP management interface via firewall rules.

Hi! I’m here to help you understand CVE-2026-113736. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...