CVE-2026-7554CWE-640

D-Link M60 httpd password recovery

Medium · published May 1, 2026

CVSS v4.0
6.3
EPSS
3%
Percentile
84.9
In the wild
Unconfirmed
What it is

A vulnerability was determined in D-Link M60 up to 1.20B02. Affected by this issue is some unknown functionality of the file /usr/bin/httpd. This manipulation causes weak password recovery. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.02551 · 84.9th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-05-01T04:45Z
EPSS history
Timeline
  • 01 MAY 04:45Z
    D-Link M60 httpd password recovery
    cvelistv5