CVE-2026-1705: XSS in D-Link DSL-6641K Web Interface

Successful exploitation of CVE-2026-1705 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the affected D-Link DSL-6641K device. This can lead to a variety of malicious actions, including stealing user credentials (usernames, passwords), redirecting users to phishing sites, or injecting malware. The attacker could potentially gain control of the device's configuration or use it as a launchpad for further attacks within the network. Given the device's role as a router, a successful attack could compromise the security of all devices connected to it.

1. Reserved2026-01-30
2. Published2026-01-30
3. Modified2026-02-23
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-1705 is to upgrade the D-Link DSL-6641K firmware to a version containing the security patch. Until an official patch is available, implement temporary mitigations such as configuring a Web Application Firewall (WAF) to filter out malicious input and implementing strict input validation on the 'Name' parameter within the advirtualserver_vdsl function. Regularly review and update WAF rules to adapt to evolving attack techniques. Monitor device logs for suspicious activity, particularly attempts to manipulate the 'Name' parameter.