D-Link DHP-W610AV CVE-2026-113736

Exploitation targets the HNAP Login component (login_prepare_hnap) of the D-Link DHP-W610AV running firmware 1.02EUb03, where the configuration default (etc/defnodes/defaultvalue.xml) leaves the administrative Password empty, enabling login without valid credentials. The practical prerequisite is network reachability to the device's HNAP/management interface; on typical home deployments this interface is bound to the LAN/Wi-Fi side rather than the WAN, so an attacker most realistically needs a foothold on the local network segment. Limiting factors: specific to the single firmware build 1.02EUb03, a niche/likely-EOL product, and dependent on the management interface being reachable from the attacker's position - no user interaction or prior authentication is required once reachable.

Signals are mixed. The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.9) describes a remote, unauthenticated, low-complexity flaw with high confidentiality/integrity/availability impact, which on paper is high priority. The E:P (Proof-of-Concept) exploit maturity is corroborated by a public PoC on GitHub, so exploit code genuinely exists. However, several factors argue against treating this as an urgent widespread threat: there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or automated exploitation; the source is VulDB, a disclosure aggregator whose auto-generated D-Link entries frequently carry inflated network-reachable CVSS vectors; and the underlying weakness (CWE-258, empty password in a configuration file) typically manifests on a device management interface that is LAN-facing rather than WAN-facing in default deployments. The AV:N rating therefore likely assumes an attacker already on the local network segment - verify with the vendor whether the HNAP interface is reachable from the WAN. Net: a credible local-network admin-compromise issue with public PoC, but absent KEV/EPSS evidence it reads as targeted/opportunistic LAN risk rather than a mass-exploited internet-wide emergency.

An attacker with access to the local network (e.g., connected to the extended Wi-Fi or a compromised LAN host) reaches the device's HNAP login interface, where the configuration default leaves the admin password empty, allowing authentication-free administrative login. A public proof-of-concept (poc_dhp610av_login.py) demonstrates logging in and confirming the empty credential, giving the attacker full control of the device to alter settings, intercept traffic, or pivot.