D-Link DWM-222W CVE-2026-6947

The device's administrative login interface must be network-accessible to the attacker. Attack success probability is inversely proportional to credential strength-devices using default credentials, weak passwords, or common credential patterns face highest risk. Attack vector classification discrepancy exists: description specifies adjacent network access requirement while CVSS vector indicates AV:N (network-accessible from any reachable network position). If adjacent network access is truly required, the attacker must be on the same Layer 2 broadcast domain or VLAN as the target device, limiting remote Internet-based exploitation. No user interaction required (UI:N) and no privileges needed (PR:N) for exploitation, meaning the vulnerability is exploitable against default configurations once network connectivity to the management interface is established. What limits exploitation: strong unique credentials create computational barriers to successful brute-force completion; network segmentation preventing attacker access to management interfaces; disabled remote administration features removing the attack surface entirely.

The CVSS 8.7 score indicates high severity, primarily driven by high integrity impact (VI:H) representing potential device takeover. However, real-world exploitability depends heavily on credential complexity-strong unique passwords significantly reduce brute-force success probability. Attack vector discrepancy exists: CVSS specifies AV:N (network) while description states 'adjacent network,' suggesting either the CVSS vector is overstated or the device unexpectedly exposes management interfaces beyond local network boundaries. No EPSS score provided, preventing probability assessment. Not listed in CISA KEV, indicating no confirmed active exploitation campaigns. No public proof-of-concept identified, lowering immediate weaponization risk. SSVC considerations: exploitation status unknown, likely automatable given network vector and lack of authentication, technical impact would be partial (device compromise but limited scope). Priority should focus on environments where these adapters have management interfaces exposed to untrusted networks or where weak default credentials are in use. Organizations using strong unique credentials face substantially lower practical risk despite high CVSS score.

An attacker on the network identifies a D-Link DWM-222W adapter's management interface through network scanning. Without authentication, they launch an automated brute-force attack using credential dictionaries or password spraying techniques against the login portal. Due to absent rate limiting, the attack proceeds unthrottled across thousands of authentication attempts until valid credentials are discovered, granting the attacker administrative control to modify Wi-Fi configurations, intercept traffic, or pivot to connected networks.