D-Link DHP-W610AV: Empty default administrator password in HNAP login
Summary
D-Link DHP-W610AV firmware 1.02EUb03 creates an administrative account 'Admin' with an empty password in the HNAP login when the device-data password is missing or invalid. An unauthenticated attacker who can reach the management interface can log in and obtain an administrative session. The root cause has not yet been confirmed by the vendor.
Affected
- D-Link DHP-W610AV, firmware 1.02EUb03
- Other firmware builds: Unknown.
Fixed in
Unknown.
Workaround
- Restrict access to the management interface; keep it off the internet and off guest or untrusted networks.
- Disable HNAP or remote management if not needed (not verified against the vendor).
- Set a strong administrator password where possible (persistence across reboots not verified; test on a spare unit first).
Exploitation
- Public proof-of-concept exploit available (GitHub).
- Exploitation in the wild: not confirmed.
- Not listed in CISA KEV. EPSS 0.9% (2026-10-26).
Our recommendation
- Inventory all DHP-W610AV units and confirm firmware 1.02EUb03.
- Restrict management access now and check for exposure from the internet.
- Replace the device if it cannot be secured; no vendor fix is known.
- Monitor HNAP login traffic and check for unexpected admin sessions or configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (VulDB) vuldb.com
- VulDB submission vuldb.com
- VulDB vulnerability 422892 vuldb.com
- GitHub evidence repository github.com
- GitHub PoC script github.com
- OffSeq threat radar radar.offseq.com
- ismalicious CVE summary ismalicious.com
- D-Link www.dlink.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:30.
Original description (NVD)
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
NVD references (7)
- https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence
- https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence/blob/main/poc/poc_dhp610av_login.py
- https://vuldb.com/cve/CVE-2026-113736
- https://vuldb.com/submit/1015789
- https://vuldb.com/vuln/422892
- https://vuldb.com/vuln/422892/cti
- https://www.dlink.com/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.