CVE-2026-1744: D-Link DSL-6641K sp_pppoe_user.js doSubmitPPP cross site scripting

Published Feb 2, 2026

Updated

A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sppppoeuser.js. The manipulation of the argument Username results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

Affected Software

3 affected components

D-Link DSL-6641K

All of the following

Dlink Dsl-6641k Firmware=n8.tr069.20131126

Dlink Dsl-6641k

Event History

Feb 2, 2026

CVE Published

via MITRE·04:32 AM

Data Sourced

via MITRE·04:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1744?

CVE-2026-1744 has a medium severity rating due to the potential for cross-site scripting attacks.

How do I fix CVE-2026-1744?

To fix CVE-2026-1744, ensure to sanitize user input in the doSubmitPPP function of the sp_pppoe_user.js file.

What products are affected by CVE-2026-1744?

CVE-2026-1744 affects the D-Link DSL-6641K router.

What type of vulnerability is CVE-2026-1744?

CVE-2026-1744 is a cross-site scripting (XSS) vulnerability.

Can CVE-2026-1744 be exploited remotely?

Yes, CVE-2026-1744 can be exploited remotely by manipulating the Username argument.