D-Link M60 CVE-2026-7554

Exploitation requires the D-Link M60 to have its HTTP web management interface accessible from the network - either directly via WAN access if remote management is enabled, or from within the local network if accessed as an internal device. The vulnerability exists in firmware version 1.20B02 and earlier. Exploitation does not require authentication (PR:N in CVSS vector), meaning an unauthenticated remote attacker can initiate the attack. However, the high attack complexity (AC:H) indicates non-trivial prerequisite steps are needed: the attacker must understand the specific password recovery flow, craft malformed requests with precise parameters, or exploit timing-dependent logic in the httpd implementation. The vulnerability is NOT exploitable against patched versions beyond 1.20B02, and is NOT exploitable if the web management interface is blocked by network access controls or the device is offline.

Despite the low CVSS score of 2.9, this vulnerability presents moderate operational concern due to several cross-signal indicators. The CVSS vector shows AV:N (network-accessible) with AC:H (high complexity), suggesting exploitation is not trivial but feasible for determined attackers. The EPSS status from input is not provided, limiting probabilistic assessment, but the public disclosure (E:P in CVSS v4.0) combined with available exploit code increases real-world risk beyond the base score. KEV status is not indicated, meaning no confirmed active exploitation in the wild has been reported by CISA. The information disclosure classification (VC:L/VI:L/VA:L) aligns with weak password recovery - attackers gain limited unauthorized access rather than full system compromise. Real priority hinges on deployment sensitivity: M60 routers in critical infrastructure or managing sensitive networks warrant immediate patching despite low severity scores, while consumer deployments may tolerate longer remediation timelines. The high attack complexity requirement acts as a natural rate-limiting factor on widespread exploitation.

An attacker identifies a D-Link M60 device on the network and analyzes the publicly disclosed exploit code to understand the password recovery weakness in the httpd binary. The attacker crafts a series of HTTP requests to the device's web management interface that exploit improper validation in the password recovery mechanism, potentially bypassing token validation or exploiting race conditions. If successful, the attacker gains access to administrative functions without providing correct credentials, potentially reconfiguring network settings or gaining access to router logs containing sensitive information.