---
id: CVE-2026-113736
title: >-
  D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty
  password
summary: >-
  A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted
  element is the function login_prepare_hnap of the file
  etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of
  the argument Password leads…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-258
  - CWE-259
vendor: D-Link
product: DHP-W610AV
affected:
  - DHP-W610AV 1.02EUb03
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:00:32.718Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113736'
references:
  - url: 'https://vuldb.com/vuln/422892'
    label: >-
      VDB-422892 | D-Link DHP-W610AV HNAP Login defaultvalue.xml
      login_prepare_hnap empty password
  - url: 'https://vuldb.com/vuln/422892/cti'
    label: 'VDB-422892 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-113736'
    label: CVE-2026-113736 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015789'
    label: 'Submit #1015789 | D-Link DHP-W610AV  1.02EUb03  Hard-coded Credentials'
  - url: 'https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence'
  - url: >-
      https://github.com/XueDugu/dlink-dhp-w610av-empty-admin-password-evidence/blob/main/poc/poc_dhp610av_login.py
  - url: 'https://www.dlink.com/'
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.054Z'
---

## Overview

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

## Affected

- `DHP-W610AV 1.02EUb03`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.