Vulnerability · Published May 1, 2026 · Assigned by VulDB

CVE-2026-7554D-Link M60 httpd password recovery

Medium 5.6

In plain English

A medium-severity security flaw in M60 from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)1.1%top 34.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in D-Link M60 up to 1.20B02. Affected by this issue is some unknown functionality of the file /usr/bin/httpd. This manipulation causes weak password recovery. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
D-Link	M60	1.20B02

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-360362 | D-Link M60 httpd password recovery vdb-entry
VDB-360362 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #805642 | https://www.dlink.com/ M60 AX6000 Wi-Fi 6 Smart Mesh Router Firmware: V1.20B02 Translation Authentication Bypass + Encrypted Integrity Check By third-party-advisory
https://www.yuque.com/iam0range/rle72q/dhs1zsbgtm1ne0y1 exploit
https://www.dlink.com/ product