Description
A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulation of the argument Username results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-02-02
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in the sp_pppoe_user.js script of the D‑Link DSL‑6641K firmware N8.TR069.20131126. Manipulation of the Username field in the doSubmitPPP function allows an attacker to inject arbitrary script payloads that are executed in the browser context of authenticated users. The injected code can deface web pages, steal session cookies or redirect users to malicious sites. The issue is identified as CWE‑79 (XSS) and CWE‑94 (code injection).

Affected Systems

Affected device is the D‑Link DSL‑6641K with firmware version N8.TR069.20131126. The product is no longer supported by the manufacturer, and no official patch is available. Consequently the risk applies only to existing units still deployed.

Risk and Exploitability

The CVSS base score is 4.8, indicating moderate risk, while the EPSS is below 1 % suggesting a low likelihood of widespread exploitation; however, the exploit is publicly known and can be launched remotely via the web interface. Because no patch exists, an organization must rely on isolation or replacement to mitigate the risk.

Generated by OpenCVE AI on April 18, 2026 at 00:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Replace the DSL‑6641K unit with a supported model or firmware that includes the fix.
  • If replacement is not possible, restrict access to the router’s web interface to a trusted internal network or VPN and block inbound traffic from the public Internet.
  • Implement a Web Application Firewall or firewall rule that denies POST requests containing script payloads to the sp_pppoe_user.js endpoint or sanitizes the Username parameter.

Generated by OpenCVE AI on April 18, 2026 at 00:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dsl-6641k
Dlink dsl-6641k Firmware
CPEs cpe:2.3:h:dlink:dsl-6641k:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dsl-6641k_firmware:n8.tr069.20131126:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dsl-6641k
Dlink dsl-6641k Firmware

Tue, 03 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dsl-6641k
Vendors & Products D-link
D-link dsl-6641k

Mon, 02 Feb 2026 05:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulation of the argument Username results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
Title D-Link DSL-6641K sp_pppoe_user.js doSubmitPPP cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

D-link Dsl-6641k
Dlink Dsl-6641k Dsl-6641k Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:14:03.054Z

Reserved: 2026-02-01T16:38:13.786Z

Link: CVE-2026-1744

cve-icon Vulnrichment

Updated: 2026-02-03T14:18:38.962Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-02T05:15:59.233

Modified: 2026-02-10T17:42:33.620

Link: CVE-2026-1744

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T01:00:11Z

Weaknesses