The vulnerability resides in the HNAP login handler of the D-Link DHP‑W610AV firmware; an attacker can manipulate the Password field in the HNAP request so that the configuration file records an empty password. This flaw enables anyone with network reach to authenticate as the privileged user without providing any credentials, effectively bypassing authentication and gaining full control over the router’s management interface. The weakness is a classic case of failing to guard against invalid or missing input and allowing a credential to be set to an insecure value, as classified by CWE‑258 and CWE‑259.

Affected is the D‑Link DHP‑W610AV router, specifically firmware version 1.02EUb03. No other vendor or product names are documented. This single device model is the target of the vulnerability.

The CVSS score of 9.3 reflects severe impact. The EPSS score is less than 1%, indicating a very low overall exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. However, the attack can be carried out remotely over the HNAP interface, and the exploit has already been disclosed publicly. The likely vector is a network‑based attacker sending crafted HNAP requests to the router, potentially from any device that can reach the target’s management network.