D-Link DSL-2740R CVE-2026-7027

Exploitation requires all of the following: (1) Remote network access to the device's web management interface (default port 80/443 or configured alternate port). (2) Valid administrative credentials to authenticate to the web interface (high privilege level required - PR:H in CVSS vector). (3) User interaction (UI:R) - an administrator must actively visit the Wireless Setup Section page after the payload is injected, either by the attacker redirecting them to the device or by the attacker storing the payload and waiting for the admin to independently access settings. (4) A browser capable of executing JavaScript (all modern browsers). The vulnerability is NOT exploitable against default deployments with unchanged default credentials if administrative access is restricted to LAN only, as this significantly limits remote attacker reach. The attack cannot be executed purely remotely without some form of administrative access or a mechanism to trick an administrator into visiting a crafted URL pointing to the device.

This vulnerability presents LOW real-world risk despite the publicly available exploit code. The CVSS vector indicates high authentication barriers (PR:H - high privilege required) and mandatory user interaction (UI:R), meaning only authenticated administrators can trigger the vulnerability, and only when they actively view a configuration page containing the malicious payload. The low CVSS score of 2.4 reflects these constraints. The EPSS data is not provided, but the public exploit availability (E:P in vector) combined with the steep authentication requirement suggests targeted, low-probability exploitation rather than opportunistic mass attacks. The vulnerability impacts confidentiality minimally (C:N) and only slightly affects integrity (I:L). No KEV listing or active exploitation confirmation is evident. The primary risk applies to organizations with compromised administrative accounts or insider threats - an attacker already having admin credentials can inject XSS to steal session cookies or perform further device manipulation when an administrator logs in. For most deployments, the authentication requirement is a significant practical barrier.

An attacker with compromised administrative credentials (or an insider) logs into the DSL-2740R web interface and enters a malicious SSID such as 'Test<script>alert(document.cookie)</script>' in the Wireless Setup Section. When a legitimate administrator later accesses the same configuration page to review or modify wireless settings, the JavaScript executes in their browser context, potentially stealing their session token, redirecting them to a phishing page, or modifying router settings without their knowledge. The publicly available exploit code demonstrates this payload injection technique.