CVE-2026-113736 (CVSS 9.8): A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap o

VulDB reports that the flaw, CVE-2026-113736, affects D-Link DHP-W610AV 1.02EUb03, and that "the impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login."[1]Threat Radar by OffSeq says that the vulnerability "can be exploited remotely without authentication" and that the exploit has been publicly disclosed, "increasing the risk of exploitation."[2] The same source says an attacker could set an empty password and so bypass authentication and gain unauthorised access.[2] Strix says the flaw "has a CVSS score of 9.8/10 (CRITICAL severity)."[3] SecOps Signal reports that "NVD rates the severity as CVSS 9.3 Critical, though one record lists it as 8.9 High."[4]VulDB's listing names the submitter as XueDugu and gives the entry's creation date as 10/20/2026.[5] Loginsoft's record links to a GitHub proof-of-concept script, "poc_dhp610av_login.py".[6]According to Hol, "the current sources do not mark it as known exploited."[7] OffSeq puts the flaw's "0.9% chance of exploitation in 30 days" at "higher than 60% of CVEs."[2]isMalicious says it has found "no fix published by the sources we read yet."[8] Zero Day Observer advises users to "isolate affected devices from untrusted networks immediately" and to "disable HNAP services if the feature is not required."[9]