{"schemaVersion":3,"id":"CVE-2026-113736","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","dates":{"published":"2026-10-21T00:00:32.718Z","modified":"2026-10-21T00:00:32.718Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"CVE.org","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":9.3,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"CVE.org","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.9,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00921,"percentile":0.59889,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-21T00:00:00.000Z","score":0.00921,"percentile":0.59889}],"last30":[{"date":"2026-10-21T00:00:00.000Z","score":0.00921,"percentile":0.59889}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_XUEDUGU_DLINK-DHP-W610AV-EMPTY-ADMIN-PASSWORD-EVIDENCE","name":"Dlink Dhp W610Av Empty Admin Password Evidence","source":"github","url":"https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence/blob/main/poc/poc_dhp610av_login.py","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-258","name":"Empty Password in Configuration File","description":"Using an empty string as a password is insecure.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/258.html"},{"id":"CWE-259","name":"Use of Hard-coded Password","description":"The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/259.html"}],"affected":[{"vendor":"d-link","product":"dhp-w610av","name":"DHP-W610AV","label":"dhp-w610av","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.02EUb03","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.02EUb03","eol":null,"hubHref":"/vendor/d-link/dhp-w610av"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://vuldb.com/vuln/422892","label":"vuldb.com/vuln/422892","hostname":"vuldb.com","tags":["VDB Entry","Technical Description"]},{"url":"https://vuldb.com/vuln/422892/cti","label":"vuldb.com/vuln/422892/cti","hostname":"vuldb.com","tags":["Signature","Permissions Required"]},{"url":"https://vuldb.com/cve/CVE-2026-113736","label":"vuldb.com/cve/CVE-2026-113736","hostname":"vuldb.com","tags":["Third Party Advisory"]},{"url":"https://vuldb.com/submit/1015789","label":"vuldb.com/submit/1015789","hostname":"vuldb.com","tags":["Third Party Advisory"]},{"url":"https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence","label":"github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence","hostname":"github.com","tags":["Related"]},{"url":"https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence/blob/main/poc/poc_dhp610av_login.py","label":"github.com/XueDugu/…","hostname":"github.com","tags":["Exploit"]},{"url":"https://www.dlink.com/","label":"www.dlink.com","hostname":"www.dlink.com","tags":["Broken Link","Product"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-21T00:00:32.718Z","label":"Published","detail":"Vulnerability first disclosed.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T18:33:43.980Z","stale":false,"partial":false}}