EUVD-2026-26480Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was determined in D-Link M60 up to 1.20B02. Affected by this issue is some unknown functionality of the file /usr/bin/httpd. This manipulation causes weak password recovery. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Weak password recovery in D-Link M60 up to version 1.20B02 allows remote attackers to compromise device authentication through manipulation of the /usr/bin/httpd binary, requiring high attack complexity but with publicly disclosed exploit code available. The vulnerability enables information disclosure and potential unauthorized access to device management functions despite the low CVSS score of 2.9 reflecting limited confidentiality impact.
Technical ContextAI
The vulnerability exists in the HTTP daemon (httpd) binary running on D-Link M60 routers and is classified as CWE-640 (Weak Password Recovery Mechanism in Core Authentication). The weakness allows attackers to exploit inadequate password recovery procedures, likely through improper validation or insufficient entropy in recovery token generation. The attack vector is network-based but requires high complexity (AC:H), suggesting the exploit involves non-trivial technical steps such as crafting specific HTTP requests, timing attacks, or bypassing security checks in the web management interface. The vulnerability affects all versions through 1.20B02 as indicated by the CPE wildcard pattern.
RemediationAI
Upgrade D-Link M60 firmware to a version newer than 1.20B02 immediately. Check D-Link's official support portal at https://www.dlink.com/ for the latest firmware release and detailed upgrade instructions specific to your M60 model variant. If a patched version is not yet available from D-Link, implement network-level compensating controls: restrict web management access (port 80/443) to trusted administrative IP addresses only using firewall rules, disable remote management if not operationally required (typically an option in device settings), and monitor HTTP logs on the device for suspicious password recovery requests. These controls reduce exposure window but do not eliminate the underlying weakness; prioritize official patching once available. Users unable to upgrade should consider segmenting the router on a trusted administrative VLAN to limit lateral movement if compromise occurs.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today