D-Link DHP-W610AV HNAP Vulnerability Enables Remote Empty Password Creation via CVE-2026-113736

A vulnerability in the D-Link DHP-W610AV powerline adapter allows remote actors to manipulate login credentials. According to the National Vulnerability Database, the issue affects firmware version 1.02EUb03. Attackers can trigger the flaw remotely, leading to an empty password being written to the configuration file. This manipulation impacts the HNAP login component, potentially allowing unauthorized access if the exploit is used.

The risk

The vulnerability, identified as CVE-2026-113736, stems from improper handling of input within the HNAP Login component. The National Vulnerability Database states the impacted element is the function `login_prepare_hnap` in the file `etc/defnodes/defaultvalue.xml`. Manipulation of the Password argument leads to an empty password in the configuration file. The NVD assigns a CVSS score of 9.3, classifying the severity as Critical, while another record lists it as 8.9, which is High.

Who is exposed

Only devices running D-Link DHP-W610AV firmware version 1.02EUb03 are confirmed affected by CVE-2026-113736. The National Vulnerability Database notes that the exploit has been disclosed to the public. This disclosure means the technical details are available, and the exploit may be used by threat actors targeting this specific hardware configuration. Users should check their device versions to determine exposure.

Cost and compliance

The source material does not provide financial impact data or specific regulatory compliance implications for CVE-2026-113736. The National Vulnerability Database records focus solely on the technical nature of the flaw, its CVSS scores, and the affected software version. There is no mention of data breaches, financial losses, or legal penalties associated with this specific vulnerability in the provided records. Organizations must assess their own risk tolerance regarding remote authentication failures.

What to watch

Security teams should prioritize identifying D-Link DHP-W610AV devices on their networks. Verification of firmware version 1.02EUb03 is essential, as this is the only confirmed affected version. Monitor for unusual login activity or configuration changes on the HNAP interface. Since the exploit allows remote initiation, external actors may attempt to exploit this vulnerability. Early detection of unauthorized access attempts can help limit exposure before full control is established.

Signals worth monitoring

Teams usually detect this type of activity by reviewing authentication logs for failed or anomalous login attempts on management interfaces. Check whether configuration files have been modified without authorization, particularly those containing credential data. Look for sudden changes in default settings or unexpected administrative access from external IP addresses. Monitor network traffic for unusual connections to the HNAP port. Isolate affected devices from the main network to prevent lateral movement while investigating the scope of the compromise.

What to do and how to stay safe: D-Link

• Inventory all D-Link DHP-W610AV devices and verify if they run firmware version 1.02EUb03.
• Restrict access to the HNAP management interface from untrusted networks using firewall rules.
• Monitor authentication logs for successful logins with empty or default credentials.
• Plan to apply vendor updates once the D-Link provides a patch for CVE-2026-113736.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific version of D-Link firmware is affected by CVE-2026-113736?

Only firmware version 1.02EUb03 of the D-Link DHP-W610AV is confirmed to be affected.

Can this vulnerability be exploited remotely?

Yes, the National Vulnerability Database states the attack can be initiated remotely.

Is there a patch available for this vulnerability?

No fix has been confirmed yet in the provided source material.