D-Link DSL-6641K Web ad_virtual_server_vdsl クロスサイトスクリプティング

Successful exploitation of CVE-2026-1705 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the affected D-Link DSL-6641K device. This can lead to a variety of malicious actions, including stealing user credentials (usernames, passwords), redirecting users to phishing sites, or injecting malware. The attacker could potentially gain control of the device's configuration or use it as a launchpad for further attacks within the network. Given the device's role as a router, a successful attack could compromise the security of all devices connected to it.

Small and medium-sized businesses (SMBs) and home users who rely on D-Link DSL-6641K routers are at risk. Specifically, those who have not updated their firmware and are using the vulnerable N8.TR069.20131126 version are particularly vulnerable. Shared hosting environments utilizing D-Link DSL-6641K routers for network connectivity are also at increased risk.

• dlink: Examine web server access logs for unusual requests targeting the advirtualserver_vdsl endpoint with suspicious parameters in the 'Name' field.

grep 'ad_virtual_server_vdsl' /var/log/httpd/access_log | grep -i 'Name=' | grep -v 'localhost'

1. 2026-01-30Disclosure

   disclosure

1. 予約済み2026-01-30
2. 公開日2026-01-30
3. 更新日2026-02-23
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-1705 is to upgrade the D-Link DSL-6641K firmware to a version containing the security patch. Until an official patch is available, implement temporary mitigations such as configuring a Web Application Firewall (WAF) to filter out malicious input and implementing strict input validation on the 'Name' parameter within the advirtualserver_vdsl function. Regularly review and update WAF rules to adapt to evolving attack techniques. Monitor device logs for suspicious activity, particularly attempts to manipulate the 'Name' parameter.