CVE-2026-7027

Root

Cause

The vulnerability resides in the Wireless Setup Section of the D-Link DSL-2740R router running firmware version EU_01.15. Manipulation of the argument “Wireless Network Name” (the SSID field) triggers a cross-site scripting (XSS) condition. This indicates that the application fails to sanitize user-supplied input before rendering it in the administrative web interface, allowing arbitrary script or HTML injection.

Attack

Vector

The attack can be executed remotely. Since the router’s web management interface is typically accessible over the local network, an unauthenticated attacker who can reach the management page may exploit the flaw by crafting a malicious SSID value that, when saved and later displayed in the browser, executes attacker-controlled scripts [1]. The exploit is publicly available, lowering the barrier to exploitation.

Impact

Successful exploitation could allow an attacker to execute JavaScript in the context of the authenticated administrator’s session. This can lead to session hijacking, defacement of the management interface, or theft of sensitive configuration data. The CVSS score is 2.4 (Low), suggesting limited direct impact, though the availability of a public exploit elevates the real-world risk for unpatched devices.

Mitigation

As of the publication date, D-Link has not released a patched firmware for the DSL-2740R. Users should restrict access to the router’s web interface to trusted local hosts only, disable remote administration if possible, and monitor for an official firmware update from D-Link [1].