EUVD-2026-26480Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was determined in D-Link M60 up to 1.20B02. Affected by this issue is some unknown functionality of the file /usr/bin/httpd. This manipulation causes weak password recovery. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Weak password recovery in D-Link M60 up to version 1.20B02 allows remote attackers to compromise device authentication through manipulation of the /usr/bin/httpd binary, requiring high attack complexity but with publicly disclosed exploit code available. The vulnerability enables information disclosure and potential unauthorized access to device management functions despite the low CVSS score of 2.9 reflecting limited confidentiality impact.
Technical ContextAI
The vulnerability exists in the HTTP daemon (httpd) binary running on D-Link M60 routers and is classified as CWE-640 (Weak Password Recovery Mechanism in Core Authentication). The weakness allows attackers to exploit inadequate password recovery procedures, likely through improper validation or insufficient entropy in recovery token generation. The attack vector is network-based but requires high complexity (AC:H), suggesting the exploit involves non-trivial technical steps such as crafting specific HTTP requests, timing attacks, or bypassing security checks in the web management interface. The vulnerability affects all versions through 1.20B02 as indicated by the CPE wildcard pattern.
RemediationAI
Upgrade D-Link M60 firmware to a version newer than 1.20B02 immediately. Check D-Link's official support portal at https://www.dlink.com/ for the latest firmware release and detailed upgrade instructions specific to your M60 model variant. If a patched version is not yet available from D-Link, implement network-level compensating controls: restrict web management access (port 80/443) to trusted administrative IP addresses only using firewall rules, disable remote management if not operationally required (typically an option in device settings), and monitor HTTP logs on the device for suspicious password recovery requests. These controls reduce exposure window but do not eliminate the underlying weakness; prioritize official patching once available. Users unable to upgrade should consider segmenting the router on a trusted administrative VLAN to limit lateral movement if compromise occurs.
The D-Link DIR-645 Wired/Wireless Router Rev. Rated high severity (CVSS 8.8), this vulnerability is no authentication re
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set
Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. Rated critical severity (
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Rated high severity (CVSS 8.0)
Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated use
D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?RE
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. Rated medium severity (CVSS 4.3), thi
Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remot
A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals
The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an
An OS command injection vulnerability exists in various legacy D-Link routers-including DIR-300 rev B and DIR-600 (firmw
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today