CVE-2026-113736

Summary

The HNAP Login component in D-Link DHP-W610AV firmware v1.02EUb03 allows remote attackers to set an empty password in the configuration file by manipulating the 'Password' argument during login preparation, bypassing authentication entirely.

Exploitability

Trivial to exploit remotely with no authentication or user interaction required, as the vulnerable endpoint is publicly accessible over HTTP.

Blast radius

Complete device compromise is possible: attackers can gain full administrative access, exfiltrate sensitive data, modify configurations, and potentially pivot to internal networks.

Detection

Look for HTTP POST requests to /HNAP1/ containing a Password field with an empty value in login_prepare_hnap calls; also monitor for subsequent administrative HNAP requests following such anomalous logins.

Prioritized remediation

Upgrade to firmware version 1.02EUb04 or later, as confirmed by D-Link security advisory; if unavailable, disable HNAP service and restrict web management access to trusted IPs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.