{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dhp-w610av-1.02eub03/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:dlink:dhp-w610av:1.02eub03:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-113736"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DHP-W610AV (1.02EUb03)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-113736","vulnerability","network-infrastructure"],"_cs_type":"threat","_cs_vendors":["D-Link"],"content_html":"\u003cp\u003eD-Link DHP-W610AV firmware version 1.02EUb03 contains a critical security vulnerability (CVE-2026-113736) within the HNAP (Home Network Administration Protocol) Login component. The issue exists in the 'login_prepare_hnap' function, located within the 'etc/defnodes/defaultvalue.xml' file. An unauthenticated remote attacker can exploit this vulnerability by manipulating the 'Password' argument during the HNAP authentication process. Successful exploitation results in the device configuration being modified to set an empty administrative password. This flaw, which carries a CVSS v3.1 base score of 9.8, provides a straightforward path for attackers to gain unauthorized administrative access to affected network devices. Public disclosure of the exploit increases the likelihood of opportunistic exploitation in the wild.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker performs network reconnaissance to identify exposed HNAP interfaces on D-Link DHP-W610AV devices.\u003c/li\u003e\n\u003cli\u003eThe attacker targets the HNAP service, typically accessible via HTTP/TCP ports often associated with device management.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the HNAP login interface.\u003c/li\u003e\n\u003cli\u003eThe request includes a manipulated 'Password' argument as defined in the 'login_prepare_hnap' function.\u003c/li\u003e\n\u003cli\u003eThe device's HNAP service processes the malformed input without proper sanitization.\u003c/li\u003e\n\u003cli\u003eThe vulnerability forces the device to overwrite the existing administrative configuration with an empty password.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates to the device management interface using the now-empty administrative credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves full administrative control over the network device for further exploitation or exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote, unauthenticated attackers to bypass authentication on D-Link DHP-W610AV devices. This leads to complete administrative takeover of the networking hardware, enabling the attacker to intercept traffic, modify network settings, or pivot deeper into the local network environment. Given the nature of the device, this could affect numerous residential or small-office environments where these powerline adapters are deployed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection and mitigation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the HNAP interface of the D-Link DHP-W610AV to trusted internal IP ranges via firewall or ACLs.\u003c/li\u003e\n\u003cli\u003eDisable remote management interfaces on the device if they are not strictly required for operation.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for HTTP POST requests directed toward HNAP-related endpoints containing anomalous 'Password' parameter values.\u003c/li\u003e\n\u003cli\u003eCheck D-Link support resources for any firmware updates that remediate CVE-2026-113736 and apply them to all managed devices immediately.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T02:15:08Z","date_published":"2026-10-21T02:15:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dlink-dhp-w610av-auth-bypass/","summary":"A critical vulnerability in D-Link DHP-W610AV allows remote attackers to force an empty password configuration via the HNAP Login interface, enabling unauthorized access.","title":"D-Link DHP-W610AV: HNAP login configuration vulnerability (CVE-2026-113736)","url":"https://feed.craftedsignal.io/briefs/2026-10-dlink-dhp-w610av-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - DHP-W610AV (1.02EUb03)","version":"https://jsonfeed.org/version/1.1"}