CVE-2026-7554: D-Link M60 httpd password recovery
A vulnerability was determined in D-Link M60 up to 1.20B02. Affected by this issue is some unknown functionality of the file /usr/bin/httpd. This manipulation causes weak password recovery. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7554?
CVE-2026-7554 is considered a high severity vulnerability due to its potential for remote exploitation affecting password recovery functionality.
How do I fix CVE-2026-7554?
To mitigate CVE-2026-7554, it is recommended to update the D-Link M60 firmware to version 1.20B03 or later as this may address the vulnerability.
What are the potential impacts of CVE-2026-7554?
CVE-2026-7554 could lead to unauthorized access or exposure of sensitive data due to weak password recovery mechanisms.
Is CVE-2026-7554 remotely exploitable?
Yes, CVE-2026-7554 can be exploited remotely, allowing attackers to manipulate the affected functionality without physical access.
Which D-Link M60 versions are affected by CVE-2026-7554?
CVE-2026-7554 affects D-Link M60 devices running any version up to and including 1.20B02.