Submit #1015789: D-Link DHP-W610AV 1.02EUb03 Hard-coded Credentials

The D-Link DHP-W610AV firmware 1.02EUb03 pre-provisions an administrative account "Admin" with an empty password in etc/defnodes/defaultvalue.xml, and the initialisation script etc/defnodes/defaultvalue.php explicitly keeps that empty password whenever the device-data password is missing, equal to the sentinel string "00000000", or shorter than 8 bytes: $password = query("/runtime/tmpdevdata/password"); if($password=="00000000" || strlen($password)<8) { set("/device/account/entry/password", ""); } else { set("/device/account/entry/password", $password); }. During boot "service DEVICE.ACCOUNT start" serialises that account into the runtime account database that the HTTP management server actually uses ("Admin" "" "0" "0" -> /tmp/passwd -> /var/passwd, plus /var/etc/hnapasswd = "Admin:" for the HNAP path). The HTTP management service is started by default when the bridge interface comes up, and its session.cgi handler (/htdocs/cgibin) authenticates against that database through the login_prepare_hnap / login_hnap challenge-response protocol. With the empty-password branch active, an unauthenticated attacker who can reach the management interface completes the normal challenge-response login with the built-in account "Admin" and an empty password and receives an authorized management session (AUTHORIZED_GROUP = 0). The CAPTCHA is disabled by default (/device/session/captcha = 0), and the HNAP login path is enabled (/inf:1/hnap = 1). The password is not secret: it is the empty string, and it is the same on every device that reaches this firmware branch. The branch is conditional: a unit that carries a valid unique device-data password (>= 8 bytes and not "00000000") uses that value instead and is not affected. The previous release 1.01EUb07 does not implement the device-data override at all and stores the account password as d41d8cd98f00b204e9800998ecf8427e (= MD5 of the empty string) with <encrypted>1</encrypted>, i.e. it ships an empty administrator password unconditionally.

Affected files and hashes:
etc/defnodes/defaultvalue.xml sha256 3a22310a36e3b293dbe2b7255936876575bd7f9580895e3ff14b4a3bb08c2f7d
etc/defnodes/defaultvalue.php sha256 c4350acc96a6570ebd4c83de49c37ef700f1ecbf78947f51eaee05d00055e17c
etc/services/DEVICE.ACCOUNT.php sha256 b726e9c1e508dcdde84ba9217aadd6fa44d3da15a63216e9d0cd67de976ae97f
etc/events/PASSWD.sh sha256 fa51882a872897667e508ed26fbcdb3fd9fcda3116ed62eae1fd8d5cb1e5d893
htdocs/cgibin sha256 fd9f21a2d026150df5626bb40099d609757fb1edd03874660665600d1ac7dd5e
sbin/httpd sha256 4433ccda8ae363216613abbc1b9cb4225be11f4ad2344e959cfe97bb1f950f30
package sha256 092f435e2c98685da166505eec7fb151669c6c1bf7f8b70b8b8f07b4df21247c
inner image sha256 6143d9ea3f1d46a8427d2e25ccc075357f663c0aef2d5aa2996b73243a1a7e16
download https://ftp.dlink.de/dhp/dhp-w610av/driver_software/DHP-W610AV_fw_reva_102eub03_EU_multi_20180504.zip

Verification. The vulnerability was verified. The empty password completes the shipped challenge-response login: login_prepare_hnap with USER=Admin returns SUCCESS with Challenge/PublicKey/Cookie; md5("") = d41d8cd98f00b204e9800998ecf8427e; the login_hnap request with the derived PASSWD returns <RESULT>SUCCESS</RESULT><AUTHORIZED_GROUP>0</AUTHORIZED_GROUP>, i.e. an authorized management session. Negative control: the same flow with a wrong password returns <RESULT>INVALIDPASSWD</RESULT><AUTHORIZED_GROUP>-1</AUTHORIZED_GROUP>, showing that the acceptance of the empty password is a real credential check performed by the vendor CGI and not a blanket authentication bypass. The vendor CGI also wrote a 376-byte authenticated session record for the successful login, and logout returned RESULT=SUCCESS. The packet capture, the session record and the login PoC are published in the evidence repository linked below. The runtime account file observed was "Admin" "" "0" "0" (/tmp/passwd) with /var/etc/hnapasswd = Admin:.

Impact. On a unit that reaches the empty-password branch, an unauthenticated attacker who can reach the management interface obtains an AUTHORIZED_GROUP = 0 (management-group) Web session without any password, and can then read and modify device configuration, wireless and network settings. Exposure of the management interface to the WAN is not claimed. The DHP-W610AV is listed by D-Link as an end-of-life / end-of-support product.

Vendor coordination: reported to D-Link SIRT ([email protected]) on 2026-10-06; the product is end-of-life, so this report is provided for the vendor's records.

CWE-258: Empty Password in Configuration File
CWE-1392: Use of Default Credentials
CWE-1188: Insecure Default Initialization
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CVSS v3.1 (equivalent estimate): CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8)

• User: XueDugu (UID 100263)
• Submission: 10/06/2026 12:48 (14 days ago)
• Moderation: 10/20/2026 18:14 (14 days later)
• Status: Accepted
• VulDB entry: 422892 [D-Link DHP-W610AV 1.02EUb03 HNAP Login defaultvalue.xml login_prepare_hnap password empty password]
• Points: 20