D-Link DSL-2740R CVE-2026-7027

Q: What is the CVSS score of CVE-2026-7027?

CVE-2026-7027 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25702 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-26 VulDB

XSS D-Link

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

4.8 (MEDIUM) 1.9 (LOW)

Severity Changed

Apr 26, 2026 - 09:22 NVD

LOW MEDIUM

CVSS changed

Apr 26, 2026 - 09:22 NVD

2.4 (LOW) 4.8 (MEDIUM)

Analysis Generated

Apr 26, 2026 - 09:00 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 08:30 euvd

EUVD-2026-25702

Analysis Generated

Apr 26, 2026 - 08:30 vuln.today

CVE Published

Apr 26, 2026 - 08:15 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability was identified in D-Link DSL-2740R EU_01.15. Impacted is an unknown function of the component Wireless Setup Section. Such manipulation of the argument Wireless Network Name leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

Cross-site scripting (XSS) in D-Link DSL-2740R EU_01.15 allows authenticated remote attackers with high privileges to inject malicious scripts via the Wireless Network Name parameter in the Wireless Setup Section, affecting data integrity when a user views the compromised configuration. The vulnerability requires user interaction and administrative credentials, limiting its real-world exploitation scope despite publicly available exploit code.

Technical ContextAI

The DSL-2740R is a residential ADSL/VDSL modem-router featuring an embedded web management interface. The Wireless Setup Section component fails to properly sanitize user-supplied input in the Wireless Network Name field before rendering it in the web interface, creating a reflected or stored XSS condition (CWE-79: Improper Neutralization of Input During Web Page Generation). This is a classic web application vulnerability where the device accepts SSID configuration input without HTML/JavaScript encoding, allowing attackers to break out of the intended context and execute arbitrary JavaScript in the browser of any administrator accessing the configuration page.

RemediationAI

Upgrade to a patched firmware version if D-Link releases one; check the official D-Link support page (https://www.dlink.com/) for firmware updates specific to the DSL-2740R EU model. If no patch is available, implement these compensating controls: (1) Restrict web management interface access to a trusted internal network only via firewall rules - block direct WAN access to the device's HTTP/HTTPS ports (typically 80/443 on the modem). (2) Disable remote management features in the device settings if the web interface supports it. (3) Use a VPN or SSH tunnel to access device administration rather than direct HTTPS. (4) Implement strong, unique administrative passwords and change default credentials immediately - the high privilege requirement (PR:H) makes brute-force attacks a prerequisite. (5) Regularly audit device configuration and session logs for signs of XSS payload injection (look for unusual SSID names containing script tags or JavaScript). Monitor for suspicious JavaScript in configuration backups.