A vulnerability in the D-Link DWM-222W USB Wi‑Fi Adapter allows an unauthenticated attacker on an adjacent network to bypass the device’s brute‑force protection and perform unlimited login attempts. By exhausting the authentication mechanism, the attacker can eventually obtain valid credentials and gain full control of the device. The weakness is a classic authentication bypass (CWE‑307).

The affected product is the D-Link DWM-222W USB Wi‑Fi Adapter. Any firmware revision earlier than 1.02.00 is vulnerable; firmware 1.02.00 and later contain the fix.

The CVSS score of 8.7 indicates a high severity. The EPSS score is less than 1 %, suggesting that the probability of exploitation is currently very low and the vulnerability is not listed in CISA’s KEV catalog. Bypassing the brute‑force protection requires an attacker to be present on the local network or in close proximity, so the attack vector is local. Once the attacker has bypassed the limits, standard brute‑force techniques can be used to gain device access and, potentially, remote control.