CVE-2026-1744

Vulnerability

Analysis

The vulnerability resides in the doSubmitPPP function within the sp_pppoe_user.js file of the D-Link DSL-6641K router running firmware version N8.TR069.20131126. The function fails to sanitize the Username argument before processing it, allowing an attacker to inject arbitrary JavaScript or HTML code. This is a classic stored or reflected cross-site scripting (XSS issue, depending on how the input is later rendered [1].

Exploitation

An attacker can exploit this flaw by crafting a malicious URL or form submission that includes a specially crafted Username parameter. The attack can be launched remotely without requiring authentication, as the vulnerable device's web interface is accessible over the network. The exploit has been publicly disclosed, increasing the risk of active targeting [1].

Impact

Successful exploitation allows an attacker to execute arbitrary script in the context of the victim's browser session when they interact with the affected page. This could lead to session hijacking, defacement, or redirection to malicious sites. However, the CVSS score of 2.4 reflects the low severity due to the need for user interaction and the limited impact on confidentiality, integrity, and availability [1].

Mitigation

D-Link has confirmed that the DSL-6641K is end-of-life and no longer supported. No patch will be provided. Users are strongly advised to replace the device with a supported model. As a temporary workaround, restrict access to the router's management interface to trusted networks only [1].